diff --git a/.github/workflows/push.yaml b/.github/workflows/push.yaml
index e4ab811..f4c9ae5 100644
--- a/.github/workflows/push.yaml
+++ b/.github/workflows/push.yaml
@@ -20,6 +20,7 @@ jobs:
 
     permissions:
       contents: read
+      packages: write # to push artifacts to `ghcr.io`
 
     name: Build
     if: github.event.pull_request.merged == true
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index fd54c25..9cd9bd8 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -18,6 +18,7 @@ jobs:
 
     permissions:
       contents: read
+      packages: write # to push artifacts to `ghcr.io`
 
     name: GoReleaser build
     runs-on: ubuntu-latest