diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index c8eeb86..57aedb5 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -13,6 +13,7 @@ jobs:
   build-push-image:
     if: ${{ github.repository == 'statnett/k3a-lag-exporter' }}
     permissions:
+      contents: read
       packages: write
     uses: ./.github/workflows/build-image.yml
     with: