diff --git a/.github/workflows/docker-build-push.yml b/.github/workflows/docker-build-push.yml
index 786e832..c3f752d 100644
--- a/.github/workflows/docker-build-push.yml
+++ b/.github/workflows/docker-build-push.yml
@@ -8,6 +8,10 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -20,7 +24,7 @@ jobs:
         id: versions
         run: |
           RUST_VERSION=$(grep -E '^[[:space:]]*RUST_VERSION=' Dockerfile | head -1 | cut -d'=' -f2)
-          NODE_VERSION=$(grep -E '^ENV NODE_VERSION' Dockerfile | head -1 | awk '{print $3}')
+          NODE_VERSION=$(grep -E '^ENV NODE_VERSION=' Dockerfile | head -1 | cut -d'=' -f2)
           IMAGE_VERSION="bookworm_rust_${RUST_VERSION}-node_${NODE_VERSION}"
           echo "rust_version=${RUST_VERSION}" >> $GITHUB_OUTPUT
           echo "node_version=${NODE_VERSION}" >> $GITHUB_OUTPUT
diff --git a/Dockerfile b/Dockerfile
index 57b99eb..014f58c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -51,7 +51,7 @@ RUN ((cat /etc/os-release | grep ID | grep alpine) && apk add --no-cache musl-de
 RUN groupadd --gid 1000 node \
   && useradd --uid 1000 --gid node --shell /bin/bash --create-home node
 
-ENV NODE_VERSION 22.22.0
+ENV NODE_VERSION=22.22.0
 
 RUN ARCH= && dpkgArch="$(dpkg --print-architecture)" \
   && case "${dpkgArch##*-}" in \
@@ -95,7 +95,7 @@ RUN ARCH= && dpkgArch="$(dpkg --print-architecture)" \
   && npm --version \
   && rm -rf /tmp/*
 
-ENV YARN_VERSION 1.22.22
+ENV YARN_VERSION=1.22.22
 
 RUN set -ex \
   # use pre-existing gpg directory, see https://github.com/nodejs/docker-node/pull/1895#issuecomment-1550389150