diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
index e7b592a4..10c47f75 100644
--- a/.github/workflows/ci-cd.yml
+++ b/.github/workflows/ci-cd.yml
@@ -120,6 +120,10 @@ jobs:
     runs-on: ubuntu-latest
     needs: [test, security]
     if: github.event_name != 'pull_request'
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
 
     steps:
     - name: Checkout code