diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index de17cc00e77..5b776bcabab 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -53,6 +53,9 @@ jobs:
             VERSION_SUFFIX: ${{ env.VERSION_SUFFIX }}
     build-docker-single-arch:
         name: build-docker-${{ matrix.binary }}-${{ matrix.cpu_arch }}${{ matrix.features.version_suffix }}
+        permissions:
+            contents: read
+            packages: write
         # Use self-hosted runners only on the sigp repo.
         runs-on: ${{ github.repository == 'sigp/lighthouse' && fromJson('["self-hosted", "linux", "release"]') || 'ubuntu-22.04'  }}
         strategy:
@@ -129,6 +132,9 @@ jobs:
 
     build-docker-multiarch:
         name: build-docker-${{ matrix.binary }}-multiarch
+        permissions:
+            contents: read
+            packages: write
         runs-on: ubuntu-22.04
         strategy:
             matrix: