diff --git a/.github/workflows/delete-untagged-image.yml b/.github/workflows/delete-untagged-image.yml
index 6b99c45..a02e095 100644
--- a/.github/workflows/delete-untagged-image.yml
+++ b/.github/workflows/delete-untagged-image.yml
@@ -7,14 +7,33 @@ on:
   # or manually
   workflow_dispatch:
 
+env:
+    # Use docker.io for Docker Hub if empty
+    REGISTRY: ghcr.io
+
 jobs:
   delete-untagged-images:
     name: Delete Untagged Images
     runs-on: ubuntu-latest
+    permissions:
+        contents: read
+        packages: write
+        # This is used to complete the identity challenge
+        # with sigstore/fulcio when running outside of PRs.
+        id-token: write
     strategy:
         matrix:
           image_name: [conda-jax, basicpy-docker-mcmicro]
     steps:
+      # Login against a Docker registry except on PR
+      # https://github.com/docker/login-action
+      - name: Log into registry ${{ env.REGISTRY }}
+        uses: docker/login-action@28218f9b04b4f3f62068d7b6ce6ca5b26e35336c
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - uses: bots-house/ghcr-delete-image-action@v1.1.0
         with:
           # NOTE: at now only orgs is supported