diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml
index b0ed0aae1..93036b842 100644
--- a/.github/workflows/docker-release.yml
+++ b/.github/workflows/docker-release.yml
@@ -3,7 +3,7 @@ name: Build Docker Image
 on:
   release:
     types:
-      - released 
+      - released    # publishing of stable releases
   pull_request:
     branches:
       - master
@@ -11,10 +11,6 @@ on:
       - '.github/workflows/docker-release.yml'
       - 'Dockerfile'
 
-permissions:
-  contents: read
-  packages: write
-
 # Cancel earlier, unfinished runs of this workflow on the same branch (unless on release)
 concurrency:
   group: "${{ github.workflow }} @ ${{ github.ref_name }}"
@@ -23,14 +19,18 @@ concurrency:
 jobs:
   docker:
     name: amd64 & arm64
+    if: ${{ github.repository_owner == 'Cockatrice' }}
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+      packages: write
+  
     steps:
       - name: Checkout
         uses: actions/checkout@v6
 
       - name: Docker metadata
-        if: ${{ github.repository_owner == 'Cockatrice' }}
         id: metadata
         uses: docker/metadata-action@v6
         with: