diff --git a/.github/workflows/publish-docker.yml b/.github/workflows/publish-docker.yml
index 9e0712ba..0e9d9d05 100644
--- a/.github/workflows/publish-docker.yml
+++ b/.github/workflows/publish-docker.yml
@@ -31,6 +31,9 @@ jobs:
             target: apinetlet-manager
           - name: metalnetlet
             target: metalnetlet-manager
+    permissions:
+      contents: read
+      packages: write
     # Condition: Run on push to main, published release, OR PR with 'ok-to-image' label
     if: |
       github.event_name == 'push' ||