diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c710ece..8d10b8d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -12,6 +12,9 @@ env:
 
 jobs:
   build:
+    permissions:
+      id-token: write # Enable OIDC
+      contents: write
     timeout-minutes: 30
     runs-on: ubuntu-latest
 
diff --git a/.github/workflows/tag.yml b/.github/workflows/tag.yml
index 44f720c..6a7757e 100644
--- a/.github/workflows/tag.yml
+++ b/.github/workflows/tag.yml
@@ -10,6 +10,9 @@ env:
 
 jobs:
   tag:
+    permissions:
+      id-token: write # Enable OIDC
+      contents: write
     timeout-minutes: 60
     runs-on: ubuntu-latest
 
diff --git a/Earthfile b/Earthfile
index 7dded70..31e301f 100644
--- a/Earthfile
+++ b/Earthfile
@@ -53,7 +53,12 @@ install:
 	SAVE ARTIFACT target/$BUILD_TARGET/release/bb
 
 common:
-	FROM registry.gitlab.com/wunker-bunker/cargo-builder
+	FROM rust
+
+	RUN apt-get update && \
+		apt-get install -y musl-dev && \
+		rustup component add clippy && \
+		rustup target add x86_64-unknown-linux-musl
 
 	WORKDIR /app
 	COPY --keep-ts --dir src/ templates/ /app