diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index f82cd1159..f03d5386d 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -11,12 +11,14 @@ on:
 
 permissions:
   contents: read
-  packages: write
 
 jobs:
   # Push to GHCR on every main branch commit; build-only on PRs
   buildx:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     concurrency:
       group: ${{ github.workflow }}-${{ github.ref }}
     steps:
diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml
index bd6aae7b4..bfc61c6ea 100644
--- a/.github/workflows/docker-release.yml
+++ b/.github/workflows/docker-release.yml
@@ -5,7 +5,6 @@ on:
 
 permissions:
   contents: read
-  packages: write
 
 jobs:
   # Push to Docker Hub on published releases (non-prerelease only)