diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bbff403..2511f87 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -57,7 +57,10 @@ jobs:
     name: Docker Build & Test
     runs-on: ubuntu-latest
     needs: lint-and-audit
-    
+    permissions:
+      contents: read
+      packages: write
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v5
@@ -148,7 +151,10 @@ jobs:
     needs: build-and-test-docker
     if: github.event_name != 'pull_request'
     continue-on-error: true
-    
+    permissions:
+      contents: read
+      packages: write
+      
     steps:
       - name: Checkout code
         uses: actions/checkout@v5