diff --git a/.github/workflows/containers-ghcr.yml b/.github/workflows/containers-ghcr.yml
index 0a4e984baedd..0c46c4a1255f 100644
--- a/.github/workflows/containers-ghcr.yml
+++ b/.github/workflows/containers-ghcr.yml
@@ -7,7 +7,11 @@ on:
 env:
   REGISTRY: ghcr.io
 
-permissions: read-all
+permissions:
+  contents: read
+  packages: write
+  attestations: write
+  id-token: write
 
 jobs:
   build_and_publish: