diff --git a/README.md b/README.md
index 6c8a0e90..7e15b5ec 100644
--- a/README.md
+++ b/README.md
@@ -28,7 +28,7 @@ on:
 # explicitly configure permissions, in case your GITHUB_TOKEN workflow permissions are set to read-only in repository settings
 permissions:
   actions: write
-  contents: write
+  contents: write # this can be 'read' if the signatures are in remote repository
   pull-requests: write
   statuses: write