diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index db5db21..2d67d4e 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -13,6 +13,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# The auto GITHUB_TOKEN needs `packages: write` to push to the forge's container
+# registry — without it Kaniko's push-permission check 401s (reqPackageAccess).
+# `contents: read` keeps git clone (checkout / Kaniko git context) working.
+permissions:
+  contents: read
+  packages: write
+
 env:
   # This forge's built-in container registry, same host as the git server.
   REGISTRY: git.ziemlichoptimal.de