diff --git a/models/repo/repo_unit.go b/models/repo/repo_unit.go
index 1fe98830ac..f4c5555cdc 100644
--- a/models/repo/repo_unit.go
+++ b/models/repo/repo_unit.go
@@ -206,7 +206,9 @@ func (p ActionsTokenPermissions) HasAccess(scope string, required perm.AccessMod
 	switch scope {
 	case "actions":
 		mode = p.Actions
-	case "code", "contents":
+	case "contents":
+		mode = min(p.Code, p.Releases)
+	case "code":
 		mode = p.Code
 	case "issues":
 		mode = p.Issues
diff --git a/services/actions/permission_parser.go b/services/actions/permission_parser.go
index 79bd4e584d..dc496fa50a 100644
--- a/services/actions/permission_parser.go
+++ b/services/actions/permission_parser.go
@@ -109,7 +109,10 @@ func parseRawPermissions(rawPerms *yaml.Node, defaultPerms repo_model.ActionsTok
 
 			// Map GitHub Actions scopes to Gitea units
 			switch scope {
-			case "code", "contents":
+			case "contents":
+				result.Code = accessMode
+				result.Releases = accessMode
+			case "code":
 				result.Code = accessMode
 			case "issues":
 				result.Issues = accessMode