diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 7c45c3f..c4515cd 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -11,6 +11,7 @@ jobs:
     runs-on: ubuntu-latest
 
     permissions:
+      contents: read # to access the repository
       pages: write # to deploy to Pages
       id-token: write # to verify the deployment originates from an appropriate source
 
diff --git a/package.json b/package.json
index ff90ee5..ab797b9 100644
--- a/package.json
+++ b/package.json
@@ -5,6 +5,7 @@
   "type": "module",
   "author": "whitewater <me@waterwater.moe>",
   "scripts": {
+    "build": "pnpm --recursive run build",
     "typeCheck": "pnpm --recursive run typeCheck",
     "lint": "pnpm --recursive run lint",
     "format": "prettier --check .",
@@ -17,5 +18,8 @@
     "typescript": "^5.3.3",
     "vitest": "^1.2.2"
   },
-  "packageManager": "pnpm@8.15.3"
+  "packageManager": "pnpm@8.15.3",
+  "engines": {
+    "node": ">=18"
+  }
 }