diff --git a/.github/workflows/dendrite.yml b/.github/workflows/dendrite.yml
index 82055199f..e1f71ea2f 100644
--- a/.github/workflows/dendrite.yml
+++ b/.github/workflows/dendrite.yml
@@ -335,6 +335,9 @@ jobs:
 
   update-docker-images:
     name: Update Docker images
+    permissions:
+      packages: write
+      contents: read
     if: github.repository == 'matrix-org/dendrite' && github.ref_name == 'main'
     needs: [integration-tests-done]
     uses: matrix-org/dendrite/.github/workflows/docker.yml@main