diff --git a/.github/workflows/prebuilt.yaml b/.github/workflows/prebuilt.yaml
index 23b3574355..990be73f72 100644
--- a/.github/workflows/prebuilt.yaml
+++ b/.github/workflows/prebuilt.yaml
@@ -17,6 +17,8 @@ jobs:
       PUSH_IMAGE: true
     permissions:
       checks: read
+      contents: read
+      packages: write
     steps:
     - name: Wait for green check mark
       if: ${{ github.event_name != 'workflow_dispatch' }}