diff --git a/.github/workflows/publish-cli.yml b/.github/workflows/publish-cli.yml
index 0aa7faa2bfd9..72ff037a071a 100644
--- a/.github/workflows/publish-cli.yml
+++ b/.github/workflows/publish-cli.yml
@@ -76,13 +76,16 @@ jobs:
       - prepare
       - build-test
 
+    permissions:
+      contents: write
+
     defaults:
       run:
         # This workflow only interacts with the client/go directory, so we can set the working directory here.
         working-directory: client/go
 
     env:
-      VERSION: ${{ needs.prepare.outputs.version }}
+      VERSION: ${{ needs.prepare.outputs.build-version }}
 
     steps:
       - uses: actions/checkout@v4
diff --git a/client/go/cond_make.go b/client/go/cond_make.go
index 6be1c012063c..514e86c63bf8 100644
--- a/client/go/cond_make.go
+++ b/client/go/cond_make.go
@@ -86,7 +86,16 @@ func latestReleasedTag(mirror string) (string, error) {
 	switch mirror {
 	case "github":
 		url := "https://api.github.com/repos/vespa-engine/vespa/releases/latest"
-		resp, err := http.Get(url)
+		token := "Bearer " + os.Getenv("GH_TOKEN")
+
+		req, err := http.NewRequest("GET", url, nil)
+		if err != nil {
+			log.Println("Error on setting up http request.\n[ERROR] -", err)
+		}
+		req.Header.Add("Authorization", token)
+
+		client := &http.Client{}
+		resp, err := client.Do(req)
 		if err != nil {
 			return "", err
 		}
@@ -100,6 +109,7 @@ func latestReleasedTag(mirror string) (string, error) {
 			return "", err
 		}
 		return release.TagName, nil
+
 	case "homebrew":
 		cmd, stdout, _ := newCmd("brew", "info", "--json", "--formula", "vespa-cli")
 		cmd.Stdout = stdout // skip printing output to os.Stdout