diff --git a/.github/workflows/build_trtllm.yaml b/.github/workflows/build_trtllm.yaml
index 3b217e69..aa75977d 100644
--- a/.github/workflows/build_trtllm.yaml
+++ b/.github/workflows/build_trtllm.yaml
@@ -15,12 +15,12 @@ on:
         description: "Label generated for this build"
         value: ${{ jobs.build-and-push.outputs.label }}
 
-permissions:
-  contents: read # Required to check out repository.
-  id-token: write # Required to authenticate via OIDC.
-
 jobs:
   build-and-push:
+    permissions:
+      contents: read # Required to check out repository.
+      id-token: write # Required to authenticate via OIDC.
+
     concurrency:
       group: ${{ github.workflow }}-${{ github.job }}-build-and-push-${{ github.head_ref || github.run_id }}
     outputs: