diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 45f9e4c8..aa562daf 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -9,14 +9,6 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      checks: write
-      issues: read
-      packages: write
-      pull-requests: read
-      repository-projects: read
-      statuses: read
     steps:
       - uses: actions/checkout@master
       - name: Set up QEMU
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 01c76a61..badbefca 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -8,6 +8,14 @@ on:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      checks: write
+      issues: read
+      packages: write
+      pull-requests: read
+      repository-projects: read
+      statuses: read
     steps:
       - uses: actions/checkout@master
       - name: Set up QEMU