diff --git a/.github/workflows/runner-variants.yml b/.github/workflows/runner-variants.yml
index b03954e7..cec52587 100644
--- a/.github/workflows/runner-variants.yml
+++ b/.github/workflows/runner-variants.yml
@@ -22,6 +22,9 @@ env:
 jobs:
   bases:
     uses: ./.github/workflows/runner-bases.yml
+    permissions:
+      contents: read
+      packages: write
   build-and-push-variants:
     needs: [ bases ]
     name: Build and push images