diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index cbbc8813b9..2369988481 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -7,6 +7,8 @@ on:
 
 jobs:
   setup:
+    permissions:
+      contents: none
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.trim.outputs.version }}
@@ -17,11 +19,10 @@ jobs:
           TAG: ${{ github.event.release.tag_name }}
 
   release:
+    permissions:
+      contents: write  # for actions/upload-release-asset to upload release asset
     needs: setup
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
     steps:
       - name: Checkout
         uses: actions/checkout@v3
@@ -48,4 +49,14 @@ jobs:
           npm publish
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          
\ No newline at end of file
+      
+      - name: Upload NPM package file
+        uses: actions/upload-release-asset@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ needs.setup.outputs.version }}
+        with:
+          upload_url: ${{ github.event.release.upload_url }}
+          asset_path: ${{ format('@xeokit/xeokit-sdk-{0}.tgz', needs.setup.outputs.version) }}
+          asset_name: ${{ format('@xeokit/xeokit-sdk-{0}.tgz', needs.setup.outputs.version) }}
+          asset_content_type: application/gzip
\ No newline at end of file