diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index e1f71649..09f8e24c 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -118,6 +118,8 @@ jobs:
         tag_name: ${{ env.RELEASE_TAG }}
 
   build_ipam:
+    permissions:
+      contents: read
     needs: push_release_tags
     name: Build IPAM container image
     if: github.repository == 'metal3-io/ip-address-manager'