diff --git a/.github/workflows/build-on-push.yaml b/.github/workflows/build-on-push.yaml
index 61dc8af..22ba7be 100644
--- a/.github/workflows/build-on-push.yaml
+++ b/.github/workflows/build-on-push.yaml
@@ -14,6 +14,9 @@ jobs:
     uses: lehmanju/containers/.github/workflows/get-changed-images.yaml@main
 
   build-images:
+    permissions:
+      contents: read
+      packages: write
     needs: ["get-changed-images"]
     if: ${{ needs.get-changed-images.outputs.addedOrModified == 'true' }}
     uses: lehmanju/containers/.github/workflows/build-images.yaml@main
diff --git a/.github/workflows/scheduled.yaml b/.github/workflows/scheduled.yaml
index 46a90d3..46acac9 100644
--- a/.github/workflows/scheduled.yaml
+++ b/.github/workflows/scheduled.yaml
@@ -22,6 +22,9 @@ jobs:
         uses: lehmanju/containers/.github/workflows/get-changed-images.yaml@main
     
     build-images:
+        permissions:
+            contents: read
+            packages: write
         needs: ["get-changed-images"]
         if: ${{ needs.get-changed-images.outputs.addedOrModified == 'true' }}
         uses: lehmanju/containers/.github/workflows/build-images.yaml@main