diff --git a/.github/workflows/web.yml b/.github/workflows/web.yml
index 8955c470a..51752c80a 100644
--- a/.github/workflows/web.yml
+++ b/.github/workflows/web.yml
@@ -27,6 +27,7 @@ jobs:
     runs-on: ubuntu-latest
 
     permissions:
+      contents: read
       packages: write
 
     steps:
@@ -55,6 +56,10 @@ jobs:
 
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+      packages: read
+
     needs: build
 
     if: github.event_name == 'push'
@@ -72,4 +77,4 @@ jobs:
         with:
           app-name: ${{ env.AZURE_WEBAPP_NAME }}
           publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE_APP_FILTERLISTS_WEB_PROD }}
-          images: ${{ env.CONTAINER_REGISTRY }}/${{ env.CONTAINER_REPOSITORY }}:${{ env.CONTAINER_IMAGE_TAG_UNIQUE }}
\ No newline at end of file
+          images: ${{ env.CONTAINER_REGISTRY }}/${{ env.CONTAINER_REPOSITORY }}:${{ env.CONTAINER_IMAGE_TAG_UNIQUE }}