diff --git a/.github/workflows/00-pr-scanner.yaml b/.github/workflows/00-pr-scanner.yaml
index 278ea458..bf607367 100644
--- a/.github/workflows/00-pr-scanner.yaml
+++ b/.github/workflows/00-pr-scanner.yaml
@@ -23,7 +23,6 @@ jobs:
     permissions:
       actions: read
       checks: read
-      contents: read
       deployments: read
       id-token: write
       issues: read
@@ -49,7 +48,7 @@ jobs:
     permissions:
       actions: read
       checks: read
-      contents: read
+      contents: write
       deployments: read
       discussions: read
       id-token: write
@@ -61,7 +60,6 @@ jobs:
       security-events: read
       statuses: read
       attestations: read
-      contents: write
     uses: ./.github/workflows/b-binary-build-and-e2e-tests.yaml
     with:
       COMPONENT_NAME: kubescape
diff --git a/.github/workflows/02-release.yaml b/.github/workflows/02-release.yaml
index 2785bb5d..a7f825b5 100644
--- a/.github/workflows/02-release.yaml
+++ b/.github/workflows/02-release.yaml
@@ -19,7 +19,6 @@ jobs:
     permissions:
       actions: read
       checks: read
-      contents: read
       deployments: read
       discussions: read
       id-token: write
@@ -31,7 +30,6 @@ jobs:
       security-events: read
       statuses: read
       attestations: write
-      contents: write
     needs: [retag]
     uses: ./.github/workflows/b-binary-build-and-e2e-tests.yaml
     with:
@@ -58,7 +56,6 @@ jobs:
       statuses: read
       security-events: read
       attestations: read
-      contents: write
     needs: [retag, binary-build]
     uses: ./.github/workflows/c-create-release.yaml
     with:
@@ -70,7 +67,6 @@ jobs:
     permissions:
       actions: read
       checks: read
-      contents: read
       deployments: read
       discussions: read
       id-token: write
diff --git a/.github/workflows/b-binary-build-and-e2e-tests.yaml b/.github/workflows/b-binary-build-and-e2e-tests.yaml
index 399619e6..bede31a5 100644
--- a/.github/workflows/b-binary-build-and-e2e-tests.yaml
+++ b/.github/workflows/b-binary-build-and-e2e-tests.yaml
@@ -164,7 +164,7 @@ jobs:
 
   build-http-image:
     permissions:
-      contents: read
+      contents: write
       id-token: write
       packages: write
       pull-requests: read
diff --git a/.github/workflows/build-image.yaml b/.github/workflows/build-image.yaml
index 29165933..f9be2065 100644
--- a/.github/workflows/build-image.yaml
+++ b/.github/workflows/build-image.yaml
@@ -23,7 +23,7 @@ jobs:
     permissions:
       id-token: write
       packages: write
-      contents: read
+      contents: write
       pull-requests: read
     uses: kubescape/workflows/.github/workflows/incluster-comp-pr-merged.yaml@main
     with:
diff --git a/.github/workflows/c-create-release.yaml b/.github/workflows/c-create-release.yaml
index b267a9ec..7e52ec2f 100644
--- a/.github/workflows/c-create-release.yaml
+++ b/.github/workflows/c-create-release.yaml
@@ -24,8 +24,8 @@ jobs:
       MAC_OS: macos-latest
       UBUNTU_OS: ubuntu-latest
       WINDOWS_OS: windows-latest
-    # permissions:
-    #   contents: write
+    permissions:
+      contents: write
     steps:
       - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # ratchet:actions/download-artifact@v3.0.2
         id: download-artifact
diff --git a/.github/workflows/d-publish-image.yaml b/.github/workflows/d-publish-image.yaml
index 8cf0a9a3..29aad7d5 100644
--- a/.github/workflows/d-publish-image.yaml
+++ b/.github/workflows/d-publish-image.yaml
@@ -2,7 +2,7 @@ name: d-publish-image
 permissions:
   actions: read
   checks: read
-  contents: read
+  contents: write
   deployments: read
   discussions: read
   id-token: write