diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index fa2b0f6..cb91c10 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -34,6 +34,11 @@ jobs:
   update-nginx:
     name: Update Nginx image
     uses: 2martens/cloud-configuration/.github/workflows/create-nginx.yaml@main
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
   deploy:
     name: Deploy
     runs-on: ubuntu-latest