diff --git a/.github/workflows/build_deploy.yml b/.github/workflows/build_deploy.yml
index 85d36d9..4ca05bf 100644
--- a/.github/workflows/build_deploy.yml
+++ b/.github/workflows/build_deploy.yml
@@ -10,6 +10,11 @@ on:
 
 jobs:
   build_test:
+    # the reusable workflow publishes the JUnit results as a check run; a called
+    # workflow cannot widen the caller's token, so the scope is granted here
+    permissions:
+      contents: read
+      checks: write
     uses: eclipse-daanse/.github/.github/workflows/reuse_java_build_test.yml@main
 
   maven_deploy: