diff --git a/.github/workflows/docker_build_kanidm.yml b/.github/workflows/docker_build_kanidm.yml
index b0a1240e3..add02cfde 100644
--- a/.github/workflows/docker_build_kanidm.yml
+++ b/.github/workflows/docker_build_kanidm.yml
@@ -10,6 +10,10 @@ name: Container - Kanidm
   push:
     branches:
       - master
+permissions:
+  packages: write
+  contents: read
+  id-token: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
diff --git a/.github/workflows/docker_build_kanidmd.yml b/.github/workflows/docker_build_kanidmd.yml
index 0f3f824d9..a5a1f149c 100644
--- a/.github/workflows/docker_build_kanidmd.yml
+++ b/.github/workflows/docker_build_kanidmd.yml
@@ -11,6 +11,10 @@ name: Container - Kanidmd
     branches:
       - master
 
+permissions:
+  packages: write
+  contents: read
+  id-token: write
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
diff --git a/.github/workflows/docker_build_radiusd.yml b/.github/workflows/docker_build_radiusd.yml
index 31bb579ff..57287ca5a 100644
--- a/.github/workflows/docker_build_radiusd.yml
+++ b/.github/workflows/docker_build_radiusd.yml
@@ -11,6 +11,10 @@ name: Container - Radiusd
     branches:
       - master
 
+permissions:
+  packages: write
+  contents: read
+  id-token: write
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true