diff --git a/.github/workflows/pr-docker-build.yml b/.github/workflows/pr-docker-build.yml
index 50bba361..931db57f 100644
--- a/.github/workflows/pr-docker-build.yml
+++ b/.github/workflows/pr-docker-build.yml
@@ -8,6 +8,10 @@ jobs:
   build-and-publish:
     runs-on: ubuntu-latest
 
+  permissions:
+    contents: read      # for actions/checkout and general read access
+    packages: write     # to push images to ghcr.io
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v4