diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 936951a3..4f2d0dc0 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -4,23 +4,35 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read # for checkout
+
 jobs:
   release:
+    name: Release
     runs-on: ubuntu-latest
     environment:
       name: epo-react-lib
     strategy:
       matrix:
         node-version: [20.9]
-    env:
-      GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
+    permissions:
+      contents: write # to be able to publish a GitHub release
+      issues: write # to be able to comment on released issues
+      pull-requests: write # to be able to comment on released pull requests
+      id-token: write # to enable use of OIDC for npm provenance
     steps:
+      - name: Checkout
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
       - name: Use Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install dependencies
         run: yarn --frozen-lockfile
-      - name: Run semantic-release
+      - name: Release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
         run: yarn release
diff --git a/packages/epo-react-lib/package.json b/packages/epo-react-lib/package.json
index 0f31fccf..d7abb426 100644
--- a/packages/epo-react-lib/package.json
+++ b/packages/epo-react-lib/package.json
@@ -80,6 +80,7 @@
     "@babel/preset-typescript": "^7.18.6",
     "@rubin-epo/epo-style-dictionary": "^0.1.0",
     "@rubin-epo/eslint-config-react": "^1.0.0-beta",
+    "@semantic-release/release-notes-generator": "^14.0.1",
     "@storybook/addon-actions": "^7.6.3",
     "@storybook/addon-essentials": "^7.6.3",
     "@storybook/addon-interactions": "^7.6.3",
diff --git a/packages/epo-react-lib/release.config.mjs b/packages/epo-react-lib/release.config.mjs
index 361a7e34..59c84aaa 100644
--- a/packages/epo-react-lib/release.config.mjs
+++ b/packages/epo-react-lib/release.config.mjs
@@ -14,6 +14,16 @@ const release = {
         ],
       },
     ],
+    [
+      "@semantic-release/release-notes-generator",
+      {
+        preset: "conventionalcommits",
+        releaseRules: [
+          { type: "refactor", release: "patch" },
+          { type: "style", release: "patch" },
+        ],
+      },
+    ],
   ],
 };
 
diff --git a/packages/epo-widget-lib/package.json b/packages/epo-widget-lib/package.json
index 05f10d72..8a8b530f 100644
--- a/packages/epo-widget-lib/package.json
+++ b/packages/epo-widget-lib/package.json
@@ -49,6 +49,7 @@
   "devDependencies": {
     "@babel/core": "^7.20.12",
     "@rubin-epo/eslint-config-react": "^1.0.0-beta",
+    "@semantic-release/release-notes-generator": "^14.0.1",
     "@storybook/addon-a11y": "^7.6.3",
     "@storybook/addon-actions": "^7.6.3",
     "@storybook/addon-docs": "^7.6.3",
diff --git a/packages/epo-widget-lib/release.config.mjs b/packages/epo-widget-lib/release.config.mjs
index 361a7e34..59c84aaa 100644
--- a/packages/epo-widget-lib/release.config.mjs
+++ b/packages/epo-widget-lib/release.config.mjs
@@ -14,6 +14,16 @@ const release = {
         ],
       },
     ],
+    [
+      "@semantic-release/release-notes-generator",
+      {
+        preset: "conventionalcommits",
+        releaseRules: [
+          { type: "refactor", release: "patch" },
+          { type: "style", release: "patch" },
+        ],
+      },
+    ],
   ],
 };
 
diff --git a/yarn.lock b/yarn.lock
index 5388bb31..7e29f737 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -4322,7 +4322,7 @@
     semver "^7.1.2"
     tempy "^3.0.0"
 
-"@semantic-release/release-notes-generator@^14.0.0-beta.1":
+"@semantic-release/release-notes-generator@^14.0.0-beta.1", "@semantic-release/release-notes-generator@^14.0.1":
   version "14.0.1"
   resolved "https://registry.yarnpkg.com/@semantic-release/release-notes-generator/-/release-notes-generator-14.0.1.tgz#0c091af7857a4dfbfc464b8256a289676f7eddd3"
   integrity sha512-K0w+5220TM4HZTthE5dDpIuFrnkN1NfTGPidJFm04ULT1DEZ9WG89VNXN7F0c+6nMEpWgqmPvb7vY7JkB2jyyA==