diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index b947163..4c68556 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -19,6 +19,10 @@ on:
         default: true
         type: boolean
 
+permissions:
+  contents: read      # ソースコードのクローンに必要
+  packages: write     # GHCR へイメージをプッシュするのに必要
+
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME_1: ${{ github.repository_owner }}/voice-rss-summary