diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index bbddbf3c01..eff6805721 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -18,6 +18,8 @@ permissions:
   packages: write
   issues: write
   pull-requests: write
+  actions: write
+  id-token: write
 
 jobs:
   core:
diff --git a/.github/workflows/login-container.yml b/.github/workflows/login-container.yml
index 1c8eab7d55..82a9a17389 100644
--- a/.github/workflows/login-container.yml
+++ b/.github/workflows/login-container.yml
@@ -12,7 +12,6 @@ jobs:
     name: Build Login Container
     runs-on: depot-ubuntu-22.04-8
     permissions:
-      contents: read
       id-token: write
     outputs:
       login_build_image: ${{ steps.get-login-tag.outputs.LOGIN_TAG }}
diff --git a/.github/workflows/login-quality.yml b/.github/workflows/login-quality.yml
index 2d9427a0d2..2212a22c18 100644
--- a/.github/workflows/login-quality.yml
+++ b/.github/workflows/login-quality.yml
@@ -18,7 +18,6 @@ jobs:
     runs-on: depot-ubuntu-22.04-8
     timeout-minutes: 30
     permissions:
-      contents: read
       id-token: write
       actions: write
     env: