diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index cf0f3b2e..6a7f8063 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -4,9 +4,13 @@ on:
     tags:
       - 'v*.*.*'
 jobs:
-  push_to_registry:
+  push-to-ghcr:
     name: Push Docker image to Docker Hub
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
     steps:
       - name: Check out the repo
         uses: actions/checkout@v3
@@ -14,25 +18,26 @@ jobs:
       - name: Set BRAMBLE_VERSION env
         run: echo "BRAMBLE_VERSION=$(git describe --tags --abbrev=0)" >> $GITHUB_ENV
 
-      - name: Docker meta
-        id: docker_meta
-        uses: docker/metadata-action@v3
-        with:
-          images: ghcr.io/movio/bramble
-
-      - name: Login to GH Container Registry
-        uses: docker/login-action@v1
+      - name: Login to ghcr.io
+        uses: docker/login-action@v2
         with:
           registry: ghcr.io
           username: ${{ secrets.REGISTRY_USERNAME }}
           password: ${{ secrets.REGISTRY_ACCESS_TOKEN }}
 
-      - name: Push to GH Container Registry
-        uses: docker/build-push-action@v2
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v4
+        with:
+          images: ghcr.io/movio/bramble
+
+      - name: Push to ghcr.io
+        uses: docker/build-push-action@v4
         with:
           context: .
           registry: ghcr.io
           push: true
           build-args: |
             VERSION=${{ env.BRAMBLE_VERSION }}
-          tags: ${{ steps.docker_meta.outputs.tags }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}