diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 6e87eaa..e4092a2 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -35,10 +35,8 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      packages:
-        write
-        # This is used to complete the identity challenge
-        # with sigstore/fulcio when running outside of PRs.
+      packages: write
+      attestations: write
       id-token: write
     steps:
       - name: Checkout repository