diff --git a/.github/workflows/build-and-publish-docker-image.yml b/.github/workflows/build-and-publish-docker-image.yml
index 05e5c7de..2c960394 100644
--- a/.github/workflows/build-and-publish-docker-image.yml
+++ b/.github/workflows/build-and-publish-docker-image.yml
@@ -81,6 +81,9 @@ jobs:
     needs: build-and-push-images
     runs-on: ubuntu-latest
     if: github.event_name != 'pull_request'
+    permissions:
+      contents: read
+      packages: write
     env:
       # Legacy name for backwards compatibility (hardcoded so it works after rename)
       LEGACY_NAME: calibre-web-automated-book-downloader
@@ -138,4 +141,4 @@ jobs:
           create_alias "${STANDARD}" "${LEGACY_TOR}"
 
           # calibre-web-automated-book-downloader-extbp → lite image
-          create_alias "${LITE}" "${LEGACY_EXTBP}"
\ No newline at end of file
+          create_alias "${LITE}" "${LEGACY_EXTBP}"