diff --git a/.forgejo/workflows/build.yaml b/.forgejo/workflows/build.yaml
index d16f8f9..3d03ddf 100644
--- a/.forgejo/workflows/build.yaml
+++ b/.forgejo/workflows/build.yaml
@@ -8,8 +8,8 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: archlinux/archlinux:base-devel
-      privileged: true
-
+    permissions:
+      contents: read
     env:
       Desktop: "template"
     steps:
@@ -42,5 +42,5 @@ jobs:
           fi
       - name: Deploy files
         run: |
-          sshpass -p "${{ env.SSHPASS }}" ssh -o StrictHostKeyChecking=no parch@${{ env.SSHHOST }} "rm -rf ${{ env.REMOTE_DIR }} && mkdir -p ${{ env.REMOTE_DIR }}"
-          sshpass -p "${{ env.SSHPASS }}" rsync -avz out/ParchLinux-${{ env.Desktop }}-latest.iso out/md5sum.txt parch@${{ env.SSHHOST }}:${{ env.REMOTE_DIR }}
+          sshpass -p "${{ secrets.SSHPASS }}" ssh -o StrictHostKeyChecking=no parch@${{ secrets.SSHHOST }} "rm -rf ${{ env.REMOTE_DIR }} && mkdir -p ${{ env.REMOTE_DIR }}"
+          sshpass -p "${{ secrets.SSHPASS }}" rsync -avz out/ParchLinux-${{ env.Desktop }}-latest.iso out/md5sum.txt parch@${{ secrets.SSHHOST }}:${{ env.REMOTE_DIR }}