diff --git a/.github/workflows/cmake.yml b/.github/workflows/cmake.yml
index e4bf63b..d9762ef 100644
--- a/.github/workflows/cmake.yml
+++ b/.github/workflows/cmake.yml
@@ -12,6 +12,9 @@ jobs:
   build:
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: write
+
     steps:
       - name: Install dependencies
         run: sudo apt-get install -y cxxtest build-essential gcc-arm-none-eabi mtools zip
@@ -66,7 +69,7 @@ jobs:
         if: startsWith(github.ref, 'refs/tags/')
         run: |
           cd ${{github.workspace}}/repo/build
-          zip -r picowota_gadget.uf2 gadget.elf firmware
+          zip -r firmware picowota_gadget.uf2 gadget.elf
 
       - name: Upload release files
         if: startsWith(github.ref, 'refs/tags/')
diff --git a/.github/workflows/scad.yml b/.github/workflows/scad.yml
index 6481653..651d261 100644
--- a/.github/workflows/scad.yml
+++ b/.github/workflows/scad.yml
@@ -7,6 +7,9 @@ jobs:
   render:
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: write
+
     steps:
       - name: Checkout repo
         uses: actions/checkout@v4