diff --git a/.github/workflows/docker-base.yaml b/.github/workflows/docker-base.yaml
index f06ab7409a..b56f33a1c3 100644
--- a/.github/workflows/docker-base.yaml
+++ b/.github/workflows/docker-base.yaml
@@ -15,6 +15,13 @@ on:
 
   workflow_dispatch:
 
+permissions:
+  contents: read
+  # Necessary to push docker images to ghcr.io.
+  packages: write
+  # Necessary for depot.dev authentication.
+  id-token: write
+
 # Avoid running multiple jobs for the same commit.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-docker-base
diff --git a/Dockerfile b/scripts/Dockerfile
similarity index 100%
rename from Dockerfile
rename to scripts/Dockerfile
diff --git a/Dockerfile.base b/scripts/Dockerfile.base
similarity index 100%
rename from Dockerfile.base
rename to scripts/Dockerfile.base
diff --git a/scripts/build_docker.sh b/scripts/build_docker.sh
index 761646e8f9..eb1726ced5 100755
--- a/scripts/build_docker.sh
+++ b/scripts/build_docker.sh
@@ -112,8 +112,8 @@ fi
 cdroot
 temp_dir="$(TMPDIR="$(dirname "$input_file")" mktemp -d)"
 ln "$input_file" "$temp_dir/coder"
-ln Dockerfile.base "$temp_dir/"
-ln Dockerfile "$temp_dir/"
+ln ./scripts/Dockerfile.base "$temp_dir/"
+ln ./scripts/Dockerfile "$temp_dir/"
 
 cd "$temp_dir"