diff --git a/.gitea/workflows/ota-build.yml b/.gitea/workflows/ota-build.yml
index 219cb24..3a18b16 100644
--- a/.gitea/workflows/ota-build.yml
+++ b/.gitea/workflows/ota-build.yml
@@ -1,7 +1,10 @@
 name: OTA build
+permissions:
+  contents: read
+  packages: write
 on: [push]
 jobs:
   build-ota:
     runs-on: ubuntu-latest
     steps:
-      - run: echo "minimal ota repro"
+      - run: echo "minimal ota repro with permissions"