diff --git a/.github/workflows/wf-build.yml b/.github/workflows/wf-build.yml
index abc46f8..eb0be1c 100644
--- a/.github/workflows/wf-build.yml
+++ b/.github/workflows/wf-build.yml
@@ -5,6 +5,10 @@ on:
       needs-push:
         type: boolean
         default: false
+permissions:
+  contents: read
+  id-token: write
+  packages: write
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -38,6 +42,14 @@ jobs:
         env:
           AWS_REGION: us-east-1
 
+      - name: Login to GHCR
+        if: inputs.needs-push
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Get tag
         id: get_tag
         run: echo "tag=${GITHUB_REF##*/}" >> "$GITHUB_OUTPUT"
@@ -54,3 +66,5 @@ jobs:
             mackerel/mackerel-agent:${{ steps.get_tag.outputs.tag }}
             public.ecr.aws/mackerel/mackerel-agent:latest
             public.ecr.aws/mackerel/mackerel-agent:${{ steps.get_tag.outputs.tag }}
+            ghcr.io/${{ github.repository_owner }}/mackerel-agent:latest
+            ghcr.io/${{ github.repository_owner }}/mackerel-agent:${{ steps.get_tag.outputs.tag }}