diff --git a/.gitea/workflows/docker.yml b/.gitea/workflows/docker.yml
index 07470fd..605e8c1 100644
--- a/.gitea/workflows/docker.yml
+++ b/.gitea/workflows/docker.yml
@@ -11,6 +11,13 @@ on:
   pull_request:
   workflow_dispatch:
 
+# Gitea derives the automatic token's scopes from this block; without it the
+# token cannot write packages and `docker login` to this instance's registry
+# fails with a bare "unauthorized".
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   build:
     # The homelab runner (a container on pluto, sharing the host docker daemon).