diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ef3ab64..c385125 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -2,6 +2,11 @@ on:
   push: {}
   workflow_dispatch: {}
 
+permissions:
+  contents: read
+  packages: write
+  id-token: write
+
 jobs:
   build-stable:
     uses: ublue-os/ucore/.github/workflows/reusable-build.yml@main