diff --git a/.github/workflows/docker-push.yml b/.github/workflows/docker-push.yml
index 28b76185..0faf5971 100644
--- a/.github/workflows/docker-push.yml
+++ b/.github/workflows/docker-push.yml
@@ -3,7 +3,11 @@ name: Create and publish a Docker image
 
 on:
   push:
-    branches: ['release']
+    branches: ["release"]
+
+permissions:
+  contents: read
+  packages: write
 
 env:
   REGISTRY: ghcr.io
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3114af0f..c1c14ec0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,6 +9,10 @@ on:
       - "v[0-9]+\\.[0-9]+\\.[0-9]+"
       - "v[0-9]+\\.[0-9]+\\.[0-9]+-rc[0-9]+"
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   release:
     runs-on: ubuntu-latest