diff --git a/.github/workflows/release-foas-lib.yml b/.github/workflows/release-foas-lib.yml
index 135973d873..5e7ecbefdb 100644
--- a/.github/workflows/release-foas-lib.yml
+++ b/.github/workflows/release-foas-lib.yml
@@ -27,7 +27,6 @@ jobs:
     needs: [ run-tests ]
     permissions:
       contents: write # required to push the release tag
-    # Tag is created only when tests pass (or are explicitly skipped).
     if: >-
       !cancelled()
       && !contains(needs.*.result, 'failure')
@@ -52,6 +51,9 @@ jobs:
     name: Failure Handler
     needs: [ run-tests, create-tag ]
     if: ${{ always() && contains(needs.*.result, 'failure') }}
+    permissions:
+      contents: write #required to open a Jira ticket / issue
+      issues: write
     uses: ./.github/workflows/failure-handler.yml
     with:
       env: "prod"