diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 71a8bfd..a26f102 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -351,7 +351,8 @@ jobs:
     timeout-minutes: 5
 
     permissions:
-      contents: write
+      contents: write  # to delete/create GitHub releases
+      packages: write  # to delete untagged docker images
 
     # run on 'main' and 'release' branch when:
     #   – build succeeded, AND