diff --git a/.github/workflows/build-devcontainer-bun.yml b/.github/workflows/build-devcontainer-bun.yml
index 3fc55fe..9554ad8 100644
--- a/.github/workflows/build-devcontainer-bun.yml
+++ b/.github/workflows/build-devcontainer-bun.yml
@@ -31,6 +31,9 @@ jobs:
 
   build:
     needs: prepare
+    permissions:
+      contents: read
+      packages: write
     uses: ./.github/workflows/reusable-docker-build.yml
     with:
       image-name: devcontainer-bun
diff --git a/.github/workflows/build-devcontainer-claude-bun.yml b/.github/workflows/build-devcontainer-claude-bun.yml
index 0c05ebd..8d7f56a 100644
--- a/.github/workflows/build-devcontainer-claude-bun.yml
+++ b/.github/workflows/build-devcontainer-claude-bun.yml
@@ -32,6 +32,9 @@ jobs:
 
   build:
     needs: prepare
+    permissions:
+      contents: read
+      packages: write
     uses: ./.github/workflows/reusable-docker-build.yml
     with:
       image-name: devcontainer-claude-bun
diff --git a/.github/workflows/build-devcontainer-hugo-bun-node.yml b/.github/workflows/build-devcontainer-hugo-bun-node.yml
index 93b0a70..10a4692 100644
--- a/.github/workflows/build-devcontainer-hugo-bun-node.yml
+++ b/.github/workflows/build-devcontainer-hugo-bun-node.yml
@@ -33,6 +33,9 @@ jobs:
 
   build:
     needs: prepare
+    permissions:
+      contents: read
+      packages: write
     uses: ./.github/workflows/reusable-docker-build.yml
     with:
       image-name: devcontainer-hugo-bun-node
diff --git a/.github/workflows/build-devcontainer-hugo-bun.yml b/.github/workflows/build-devcontainer-hugo-bun.yml
index 4cf83fc..31b6930 100644
--- a/.github/workflows/build-devcontainer-hugo-bun.yml
+++ b/.github/workflows/build-devcontainer-hugo-bun.yml
@@ -32,6 +32,9 @@ jobs:
 
   build:
     needs: prepare
+    permissions:
+      contents: read
+      packages: write
     uses: ./.github/workflows/reusable-docker-build.yml
     with:
       image-name: devcontainer-hugo-bun
diff --git a/.github/workflows/build-ralphex-fe.yml b/.github/workflows/build-ralphex-fe.yml
index b202d3a..c964178 100644
--- a/.github/workflows/build-ralphex-fe.yml
+++ b/.github/workflows/build-ralphex-fe.yml
@@ -47,6 +47,9 @@ jobs:
 
   build:
     needs: prepare
+    permissions:
+      contents: read
+      packages: write
     uses: ./.github/workflows/reusable-docker-build.yml
     with:
       image-name: ralphex-fe
diff --git a/.github/workflows/update-and-build-ralphex-fe.yml b/.github/workflows/update-and-build-ralphex-fe.yml
index 4016902..ce07904 100644
--- a/.github/workflows/update-and-build-ralphex-fe.yml
+++ b/.github/workflows/update-and-build-ralphex-fe.yml
@@ -142,6 +142,9 @@ jobs:
 
   build-and-push:
     needs: update-dockerfile
+    permissions:
+      contents: read
+      packages: write
     # Build if versions changed and update_only is not checked
     if: ${{ needs.update-dockerfile.outputs.versions_updated == 'true' && inputs.update_only == false }}
     uses: ./.github/workflows/reusable-docker-build.yml