diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
index 958e8c3..f274c9d 100644
--- a/.forgejo/workflows/release.yml
+++ b/.forgejo/workflows/release.yml
@@ -5,9 +5,11 @@
 # Requirements:
 #   - A Forgejo Actions runner on the instance. Adjust `runs-on` to a label
 #     your runner actually advertises (common: docker, ubuntu-latest).
-#   - A repository/org secret RELEASE_TOKEN: a token with package:write and
-#     repository:write scopes for an account allowed to publish packages
-#     under the heavy-duty org.
+#   - A repository/org secret RELEASE_TOKEN: a token with read:user,
+#     write:package and write:repository scopes for an account allowed to
+#     publish packages under the heavy-duty org. read:user is required because
+#     publish-release.sh runs `stoke auth login`, which validates the token
+#     against /user.
 
 name: release
 on:
diff --git a/changelog.d/60.md b/changelog.d/60.md
new file mode 100644
index 0000000..ad85c87
--- /dev/null
+++ b/changelog.d/60.md
@@ -0,0 +1 @@
+- Correct the release workflow's documented token scopes to include the identity check required before publishing. (#60).