diff --git a/.github/workflows/build_trtllm.yaml b/.github/workflows/build_trtllm.yaml
index faa9c606..b48cbb9f 100644
--- a/.github/workflows/build_trtllm.yaml
+++ b/.github/workflows/build_trtllm.yaml
@@ -19,12 +19,12 @@ on:
         description: "Label generated for this build"
         value: ${{ jobs.build-and-push.outputs.label }}
 
-permissions:
-  contents: read # Required to check out repository.
-  id-token: write # Required to authenticate via OIDC.
-
 jobs:
   build-and-push:
+    permissions:
+      contents: read # Required to check out repository.
+      id-token: write # Required to authenticate via OIDC.
+
     concurrency:
       group: ${{ github.workflow }}-${{ github.job }}-${{ github.head_ref || github.run_id }}
     outputs: