diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b92548c..e6b5a3e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,7 +16,9 @@ on:
     # tags:
     #   - v* # Push events to matching v*, i.e. v1.0, v20.15.10
 
-permissions: read-all
+# by default, permissions are read-only, read + write is required for git pushes
+permissions:
+  contents: write
 
 jobs:
   build: