diff --git a/.github/workflows/build-baremetal-ubuntu.yml b/.github/workflows/build-baremetal-ubuntu.yml
index f01a4fe..24acfd0 100644
--- a/.github/workflows/build-baremetal-ubuntu.yml
+++ b/.github/workflows/build-baremetal-ubuntu.yml
@@ -13,6 +13,7 @@ env:
   DEBIAN_FRONTEND: "noninteractive"
   FFMPEG_COMMIT_ID: "n6.1.1"
   BUILD_DIR: "${{ github.workspace }}/build"
+  BUILD_FFMPEG_DIR: "${{ github.workspace }}/build-ffmpeg"
   PREFIX: "${{ github.workspace }}/_install"
 
 defaults:
@@ -44,7 +45,7 @@ jobs:
     - name: 'Install OS level dependencies'
       run: |
         set -exo pipefail && \
-        mkdir -p "${PREFIX}" "${BUILD_DIR}/ffmpeg" && \
+        mkdir -p "${PREFIX}" "${BUILD_DIR}" "${BUILD_FFMPEG_DIR}" && \
         sudo apt-get update --fix-missing && \
         sudo apt-get full-upgrade -y && \
         sudo apt-get install --no-install-recommends -y \
@@ -76,9 +77,9 @@ jobs:
     - name: 'Download and patch ffmpeg repository'
       run: |
         set -eo pipefail && \
-        curl -Lf https://github.com/ffmpeg/ffmpeg/archive/${FFMPEG_COMMIT_ID}.tar.gz | tar -zx --strip-components=1 -C "${BUILD_DIR}/ffmpeg"
-        patch -d "${BUILD_DIR}/ffmpeg" -p1 -i <(cat "${{ github.workspace }}/ffmpeg/"*.patch)
-        cp "${{ github.workspace }}/ffmpeg/vf_raisr"*.c "${BUILD_DIR}/ffmpeg/libavfilter"
+        curl -Lf https://github.com/ffmpeg/ffmpeg/archive/${FFMPEG_COMMIT_ID}.tar.gz | tar -zx --strip-components=1 -C "${BUILD_FFMPEG_DIR}"
+        patch -d "${BUILD_FFMPEG_DIR}" -p1 -i <(cat "${{ github.workspace }}/ffmpeg/"*.patch)
+        cp "${{ github.workspace }}/ffmpeg/vf_raisr"*.c "${BUILD_FFMPEG_DIR}/libavfilter"
 
     - name: 'Build RAISR from source code'
       run: |
@@ -88,9 +89,9 @@ jobs:
           -DCMAKE_CXX_FLAGS="-I/opt/intel/oneapi/ipp/latest/include -I/opt/intel/oneapi/ipp/latest/include/ipp"
 
     - name: 'Configure ffmpeg repository'
-      working-directory: "ffmpeg"
       continue-on-error: true
       run: |
+        cd "${BUILD_FFMPEG_DIR}"
         ./configure \
           --disable-shared \
           --disable-debug  \
@@ -109,9 +110,9 @@ jobs:
         { tail -n 100 "${BUILD_DIR}/ffmpeg/ffbuild/config.log" && exit 1; }
 
     - name: 'Build, install and check ffmpeg'
-      working-directory: "ffmpeg"
       continue-on-error: true
       run: |
+        cd "${BUILD_FFMPEG_DIR}"
         make clean
         make -j"$(nproc)"
         sudo -E make install
diff --git a/.github/workflows/docker-cached-build.yml b/.github/workflows/docker-cached-build.yml
index 34475e5..60d01a3 100644
--- a/.github/workflows/docker-cached-build.yml
+++ b/.github/workflows/docker-cached-build.yml
@@ -7,6 +7,9 @@ on:
     branches: [ "main", "dev" ]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: true
@@ -17,7 +20,6 @@ jobs:
     uses: ./.github/workflows/template-docker-cached-build.yml
     permissions:
       security-events: write
-      packages: write
       contents: read
     with:
       docker_file_path:  "docker/Flex/Dockerfile.ubuntu22.04"
@@ -28,7 +30,6 @@ jobs:
     uses: ./.github/workflows/template-docker-cached-build.yml
     permissions:
       security-events: write
-      packages: write
       contents: read
     with:
       docker_file_path:  "docker/Xeon/Dockerfile.ubuntu18.04"
@@ -39,7 +40,6 @@ jobs:
     uses: ./.github/workflows/template-docker-cached-build.yml
     permissions:
       security-events: write
-      packages: write
       contents: read
     with:
       docker_file_path:  "docker/Xeon/Dockerfile.ubuntu20.04"
@@ -50,7 +50,6 @@ jobs:
     uses: ./.github/workflows/template-docker-cached-build.yml
     permissions:
       security-events: write
-      packages: write
       contents: read
     with:
       docker_file_path:  "docker/Xeon/Dockerfile.ubuntu22.04"
@@ -61,7 +60,6 @@ jobs:
     uses: ./.github/workflows/template-docker-cached-build.yml
     permissions:
       security-events: write
-      packages: write
       contents: read
     with:
       docker_file_path:  "docker/Xeon/Dockerfile.centos9"
@@ -72,7 +70,6 @@ jobs:
     uses: ./.github/workflows/template-docker-cached-build.yml
     permissions:
       security-events: write
-      packages: write
       contents: read
     with:
       docker_file_path:  "docker/Xeon/Dockerfile.rockylinux9-mini"
diff --git a/.github/workflows/template-docker-cached-build.yml b/.github/workflows/template-docker-cached-build.yml
index b73a420..fb63e7f 100644
--- a/.github/workflows/template-docker-cached-build.yml
+++ b/.github/workflows/template-docker-cached-build.yml
@@ -117,7 +117,6 @@ jobs:
     permissions:
       contents: read
       security-events: write
-      packages: write
     timeout-minutes: 70
     env:
       BUILDKIT_STEP_LOG_MAX_SIZE: 50000000