diff --git a/.gitea/workflows/publish.yml b/.gitea/workflows/publish.yml
index f1b4757..02d4dbe 100644
--- a/.gitea/workflows/publish.yml
+++ b/.gitea/workflows/publish.yml
@@ -14,9 +14,12 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-
       - name: Retrieve latest
-        run: curl -o ".gitea/workflows/publish.yml" "${{ gitea.server_url }}/${{ gitea.repository }}/raw/branch/master/.gitea/workflows/publish.yml"
+        env:
+          WORKFLOW_URL: ${{ gitea.server_url }}/${{ gitea.repository }}/raw/branch/master/.gitea/workflows/publish.yml
+        run: |
+          echo "Retrieving latest workflow from $WORKFLOW_URL" && \
+          curl -f -o ".gitea/workflows/publish.yml" "$WORKFLOW_URL"
       
       - name: check for diff
         run: git update-index --refresh
@@ -26,7 +29,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Build and publish
     permissions:
-      contents: write
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@v4