diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index cb7a64a706..a2e4d53c90 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -20,6 +20,11 @@ permissions:
 jobs:
   build:
     runs-on: ${{ matrix.os }}
+    permissions:
+      # read to fetch code (actions/checkout)
+      # write to push code to gh-pages, create releases
+      # note: forked repositories will have maximum read access
+      contents: write
     continue-on-error: false
     strategy:
       matrix: