diff --git a/.github/workflows/build-docker.yml b/.github/workflows/build-docker.yml
index 88b0342cd..3df2f80f5 100644
--- a/.github/workflows/build-docker.yml
+++ b/.github/workflows/build-docker.yml
@@ -348,6 +348,8 @@ jobs:
       - docker-plan
       - docker-publish-base
       - docker-publish-extra
+    permissions:
+      attestations: write # for GHCR attestations
     if: ${{ needs.docker-plan.outputs.push == 'true' }}
     steps:
       - uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0