diff --git a/.github/workflows/build-fb-image.yaml b/.github/workflows/build-fb-image.yaml
index e2b1e1ac6..b90cd97cc 100644
--- a/.github/workflows/build-fb-image.yaml
+++ b/.github/workflows/build-fb-image.yaml
@@ -20,6 +20,10 @@ env:
   DOCKER_IMAGE: 'fluent-bit'
   GITHUB_IMAGE: '${{ github.repository }}/fluent-bit'
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   build-prod-image-metadata:
     runs-on: ubuntu-latest