diff --git a/.gitea/workflows/flake-update.yaml b/.gitea/workflows/flake-update.yaml
index e109afb..274be24 100644
--- a/.gitea/workflows/flake-update.yaml
+++ b/.gitea/workflows/flake-update.yaml
@@ -1,5 +1,8 @@
 name: "Flake.lock: update Nix dependencies for development environment only"
 
+permissions:
+  contents: write
+
 on:
   workflow_dispatch: # allows manual triggering
   schedule: