diff --git a/.github/workflows/build-containers.yaml b/.github/workflows/build-containers.yaml
index 1249bba07..efc230746 100644
--- a/.github/workflows/build-containers.yaml
+++ b/.github/workflows/build-containers.yaml
@@ -20,6 +20,7 @@ jobs:
     permissions:
       packages: write
       contents: read
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
 
     steps:
       - uses: actions/checkout@v4