diff --git a/.gitea/workflows/coder-templates.yml b/.gitea/workflows/coder-templates.yml
index cebe393..e83b5e0 100644
--- a/.gitea/workflows/coder-templates.yml
+++ b/.gitea/workflows/coder-templates.yml
@@ -59,6 +59,12 @@ jobs:
     # container.volumes mount for the same path here fails at container
     # creation with "Duplicate mount point: /var/run/docker.sock".
     runs-on: docker-build
+    # Currently a no-op (see the PACKAGE_REGISTRY_TOKEN note above) but
+    # harmless to declare now - once go-gitea/gitea#39070 ships, GITEA_TOKEN
+    # will need this to get package write access, so this is one less thing
+    # to remember when PACKAGE_REGISTRY_TOKEN can eventually be retired.
+    permissions:
+      packages: write
     outputs:
       failed_templates: ${{ steps.build.outputs.failed_templates }}
     # docker:27-cli (Alpine) has no bash - only the POSIX /bin/sh (busybox