diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml
index beb6304..b4aa16a 100644
--- a/.github/workflows/automerge.yml
+++ b/.github/workflows/automerge.yml
@@ -20,6 +20,13 @@ on:
     types:
       - completed
   status: {}
+
+# Least-privilege: pascalgn/automerge-action merges PRs with GITHUB_TOKEN,
+# which requires contents:write (merge) and pull-requests:write.
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   automerge:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 3dd7d42..2eb8707 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -9,10 +9,10 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: read
+  pull-requests: write
+  contents: write
   pages: write
   id-token: write
-  packages: read
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
@@ -29,15 +29,19 @@ jobs:
         with:
           submodules: true
 
-      - name: Setup Flavor
-        uses: actions-mn/setup-flavors@main
-        with:
-          extra-flavors: ribose
-          github-packages-token: ${{ secrets.METANORMA_CI_PAT_TOKEN }}
-          use-bundler: true
-
       - name: Metanorma generate site
+        id: build-and-publish
         uses: actions-mn/build-and-publish@main
         with:
+          token: ${{ secrets.GITHUB_TOKEN }}
           agree-to-terms: true
           destination: artifact
+
+  deploy:
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - name: Deploy to GitHub Pages
+        uses: actions-mn/deploy-pages@v1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}