diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml
index beb6304b..b4aa16a2 100644
--- a/.github/workflows/automerge.yml
+++ b/.github/workflows/automerge.yml
@@ -20,6 +20,13 @@ on:
     types:
       - completed
   status: {}
+
+# Least-privilege: pascalgn/automerge-action merges PRs with GITHUB_TOKEN,
+# which requires contents:write (merge) and pull-requests:write.
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   automerge:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ab1df822..c6f56c86 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,5 +1,30 @@
 # Auto-generated by Cimas: Do not edit it manually!
 # See https://github.com/metanorma/cimas
+# Variant of `release.yml` for gems whose maintainers write GitHub Release
+# notes by hand at release time and want to opt out of the auto-generated
+# notes floor introduced in metanorma/ci#354.
+#
+# The only difference from the parent `release.yml` template is the
+# `release_notes: manual` input passed to the reusable `rubygems-release.yml`
+# — that flag makes the reusable's Ensure-GitHub-Release step skip itself
+# entirely, leaving Release creation + notes authoring to the maintainer.
+#
+# Used by opoudjis-maintained gems (all `metanorma-*` except
+# `metanorma-plugin-*` and `metanorma-utils`, plus `isodoc`, `isodoc-i18n`,
+# `basicdoc-models`). See the `release_wo_bundle_install_manual_notes.yml`
+# sibling variant for gems that also opt out of the shared workflow's
+# implicit bundle install (metanorma-utils today). Gems mapping
+# `release_github_packages.yml` are exempt-by-construction — that
+# template calls `ghpkg-release.yml`, not `rubygems-release.yml`, so
+# metanorma/ci#354's auto-notes floor doesn't reach them.
+#
+# To switch from opt-out back to the auto-notes floor: change the
+# cimas.yml mapping for this gem from `master/release_manual_notes.yml`
+# back to `master/release.yml`. No content edit needed.
+#
+# See metanorma/ci#354 for the rationale and metanorma/ci#PR-number for
+# the introduction of this variant.
+
 name: release
 
 on:
@@ -14,22 +39,22 @@ on:
   repository_dispatch:
     types: [ do-release ]
 
+# Least-privilege ceiling for the called rubygems-release.yml: its release job
+# needs contents:write (git tag push) and id-token:write (OIDC Trusted Publishing).
+permissions:
+  contents: write
+  id-token: write
+
 jobs:
   release:
     uses: metanorma/ci/.github/workflows/rubygems-release.yml@main
     with:
       next_version: ${{ github.event.inputs.next_version }}
-      # Explicit release_command needed since metanorma/ci#314 deprecated
-      # `bundler_cache` (hardcoded to false) — the reusable's release job no
-      # longer runs `bundle install` implicitly via ruby/setup-ruby, so the
-      # default `bundle exec rake release` fires against uninstalled gems.
-      # Surfaced by kwkwan on metanorma-plugin-lutaml#285. Deeper fix
-      # (bundle install inside rubygems-release.yml's release job) tracked
-      # separately.
-      release_command: |
-        bundle install
-        bundle exec rake release
+      # Opt out of the auto-generated GitHub Release notes floor added in
+      # metanorma/ci#354. Notes are written by hand at release time; the
+      # workflow skips the ensure-release step entirely and the maintainer
+      # creates the Release with their own notes.
+      release_notes: manual
     secrets:
       rubygems-api-key: ${{ secrets.METANORMA_CI_RUBYGEMS_API_KEY }}
       pat_token: ${{ secrets.METANORMA_CI_PAT_TOKEN }}
-