diff --git a/.github/workflows/flowzone.yml b/.github/workflows/flowzone.yml
index 0a5feed..cfb99e5 100644
--- a/.github/workflows/flowzone.yml
+++ b/.github/workflows/flowzone.yml
@@ -9,7 +9,9 @@ on:
     branches: [main, master]
 
 permissions:
-  id-token: "write"  # AWS GitHub OIDC required: write (tests)
+  contents: read
+  id-token: "write"  # AWS GitHub OIDC required: write
+  packages: read
 
 jobs:
   flowzone: