diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index b9915b8f6a..fcccc7eb8a 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -26,7 +26,8 @@ jobs:
   docker:
     name: Build, test, and publish Docker images to Docker Hub
     permissions:
-      contents: write  # for docker to push to registry
+      contents: read
+      packages: write  # for docker to push to registry
     runs-on: ubuntu-latest
 
     steps: