diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 2225a9f..6c6ca22 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -8,6 +8,9 @@ on:
       - trunk
       - releases
 
+permissions:
+  contents: write
+
 
 env:
   GO_VERSION: "1.26.0"
@@ -117,6 +120,10 @@ jobs:
           cache: true
           go-version: ${{ env.GO_VERSION }}
 
+      - name: Prepare git for tag push
+        run: |
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
       - name: Determine version for ${{ matrix.module }}
         id: version
         run: |
@@ -219,6 +226,10 @@ jobs:
           cache: true
           go-version: ${{ env.GO_VERSION }}
 
+      - name: Prepare git for tag push
+        run: |
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
       - name: Determine version for ${{ matrix.module }}
         id: version
         run: |