diff --git a/.gitea/workflows/build-and-push.yaml b/.gitea/workflows/build-and-push.yaml
index f0718f8..54b6cec 100644
--- a/.gitea/workflows/build-and-push.yaml
+++ b/.gitea/workflows/build-and-push.yaml
@@ -8,6 +8,10 @@ on:
     - cron: '0 5 * * 0'
   workflow_dispatch:
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   release-and-build:
     runs-on: buildx-multiarch