diff --git a/.github/workflows/X-x86_64_X.yml b/.github/workflows/X-x86_64_X.yml
index eddb482..356187e 100644
--- a/.github/workflows/X-x86_64_X.yml
+++ b/.github/workflows/X-x86_64_X.yml
@@ -38,6 +38,14 @@ on:
   #watch:
   #  types: [started]
 
+permissions:
+  contents: write
+  actions: write
+
+concurrency:
+  group: openwrt-release-${{ github.ref }}
+  cancel-in-progress: false
+
 ### 环境变量设置
 env:
 # 编译时调用的 [.config] 文件名称
diff --git a/.github/workflows/X-x86_64_Y.yml b/.github/workflows/X-x86_64_Y.yml
index 05b908a..1318040 100644
--- a/.github/workflows/X-x86_64_Y.yml
+++ b/.github/workflows/X-x86_64_Y.yml
@@ -38,6 +38,14 @@ on:
   #watch:
   #  types: [started]
 
+permissions:
+  contents: write
+  actions: write
+
+concurrency:
+  group: openwrt-release-${{ github.ref }}
+  cancel-in-progress: false
+
 ### 环境变量设置
 env:
 # 编译时调用的 [.config] 文件名称
diff --git a/.github/workflows/X-x86_64_Z.yml b/.github/workflows/X-x86_64_Z.yml
index 163f58a..fc2b10c 100644
--- a/.github/workflows/X-x86_64_Z.yml
+++ b/.github/workflows/X-x86_64_Z.yml
@@ -38,6 +38,14 @@ on:
   #watch:
   #  types: [started]
 
+permissions:
+  contents: write
+  actions: write
+
+concurrency:
+  group: openwrt-release-${{ github.ref }}
+  cancel-in-progress: false
+
 ### 环境变量设置
 env:
 # 编译时调用的 [.config] 文件名称
diff --git a/AI_CHANGELOG_WORKFLOW_PERMISSIONS_CONCURRENCY.md b/AI_CHANGELOG_WORKFLOW_PERMISSIONS_CONCURRENCY.md
new file mode 100644
index 0000000..c8f8b83
--- /dev/null
+++ b/AI_CHANGELOG_WORKFLOW_PERMISSIONS_CONCURRENCY.md
@@ -0,0 +1,15 @@
+# AI Modification Log: Workflow Permissions And Concurrency
+
+Date: 2026-06-29
+
+## Change
+
+- Added explicit workflow permissions to X/Y/Z workflows:
+  - `contents: write`
+  - `actions: write`
+- Added workflow-level concurrency grouped by `openwrt-release-${{ github.ref }}`.
+- Set `cancel-in-progress: false` so existing long-running builds are not cancelled automatically.
+
+## Reason
+
+Release uploads need content write permission, and workflow-run cleanup needs actions write permission. Concurrency prevents multiple runs of the same workflow/ref from racing on shared release tags and dated upload paths.