diff --git a/.github/release-drafter.yml b/.github/release-drafter.yml
index 3b2abfe..f904165 100644
--- a/.github/release-drafter.yml
+++ b/.github/release-drafter.yml
@@ -65,8 +65,19 @@ categories:
     when:
       labels: [dependencies]
 
-change-template: '- $TITLE ([#$NUMBER]($URL)) @$AUTHOR'
+# Dependabot bumps the same dependency several times between releases, most
+# often the plexus parent and plexus-testing. Group each dependency into one
+# entry with the full version range; $NUMBERS lists every pull request of it.
+# group_in keeps a bump in one module apart from the same bump in another.
+group-changes:
+  - pattern: '/^Bump (?<group>.+?) from (?<from>\S+) to (?<to>\S+)(?<group_in> in \S+)?$/'
+    title-template: 'Bump $GROUP from $FIRST_FROM to $LAST_TO$GROUP_IN'
 
+change-template: '- $TITLE ($NUMBERS) @$AUTHOR'
+
+# $RESOLVED_TAG is the tag-template a repo sets, so the link includes its prefix.
 template: |
   <!-- Optional: add a release summary here -->
   $CHANGES
+
+  [Full changelog](https://github.com/$OWNER/$REPOSITORY/compare/$PREVIOUS_TAG...$RESOLVED_TAG)
diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml
index a3d0199..fc4407e 100644
--- a/.github/workflows/release-drafter.yml
+++ b/.github/workflows/release-drafter.yml
@@ -5,7 +5,10 @@ on:
 jobs:
   update_release_draft:
     runs-on: ubuntu-latest
+    # The draft release needs contents: write, reading merged pull requests
+    # needs pull-requests: read. Every calling repo grants both by default.
+    permissions:
+      contents: write
+      pull-requests: read
     steps:
       - uses: release-drafter/release-drafter@v7.9.0
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}