diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c315c56..f11cfb7 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -175,6 +175,9 @@ jobs:
     needs: [build-services, build-dashboard]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: self-hosted-gremlin
+    permissions:
+      contents: read
+      packages: read
     steps:
       - uses: actions/checkout@v5
 
@@ -214,6 +217,8 @@ jobs:
           kubectl cluster-info || echo "WARNING: kubectl cannot reach cluster API"
 
       - name: Run integration tests
+        env:
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           bash infra/inttest/run_pipeline.sh \
             --image-tag ${{ github.sha }} \