diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f7e3d19d..73f5bd25 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -75,6 +75,9 @@ jobs:
 
   ghcr-image:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
 
     steps:
       - name: Checkout code
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8caa8f49..d94dd472 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -51,6 +51,9 @@ jobs:
 
   ghcr-image:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
 
     steps:
       - name: Checkout code
@@ -72,3 +75,4 @@ jobs:
         run:
           docker build -t ghcr.io/antonengelhardt/wasm-oidc-plugin:${{ env.VERSION }} .
           docker push ghcr.io/antonengelhardt/wasm-oidc-plugin:${{ env.VERSION }}
+          
\ No newline at end of file