diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index 945650e..fdf0602 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -6,7 +6,9 @@
 #   - repo Secrets:  COSIGN_PRIVATE_KEY, COSIGN_PASSWORD, COSIGN_PUBLIC_KEY
 name: spike-build
 on: [push, workflow_dispatch]
-permissions: {}
+permissions:
+  contents: read
+  packages: write        # required to push the image to Forgejo's registry
 env:
   REGISTRY: ${{ vars.FORGEJO_REGISTRY }}
 jobs: