diff --git a/.github/workflows/scorecard.yaml b/.github/workflows/scorecard.yaml
index a177f87f..fd722716 100644
--- a/.github/workflows/scorecard.yaml
+++ b/.github/workflows/scorecard.yaml
@@ -13,6 +13,18 @@ permissions: read-all
 jobs:
   validate:
     permissions:
+      actions: read
+      attestations: read
+      checks: read
+      contents: read
+      deployments: read
+      discussions: read
+      issues: read
+      packages: read
+      pages: read
+      pull-requests: read
+      repository-projects: read
+      statuses: read
       # Needed to upload the results to code-scanning dashboard.
       security-events: write
       # Used to receive a badge.
diff --git a/tasks.yaml b/tasks.yaml
index 5832e23b..68b11cd4 100644
--- a/tasks.yaml
+++ b/tasks.yaml
@@ -78,7 +78,9 @@ tasks:
     actions:
       - task: actions:determine-arch
       - task: publish:build-package
+      - task: setup:k3d-test-cluster
+        if: ${{ or (ne .variables.FLAVOR "upstream") (ne .variables.ARCH "arm64") }}
       - task: create-deploy-test-bundle
-        if: ${{ and (ne .variables.FLAVOR "upstream") (ne .variables.ARCH "arm64") }}
+        if: ${{ or (ne .variables.FLAVOR "upstream") (ne .variables.ARCH "arm64") }}
       - task: publish:publish-package
       - task: publish:publish-plugin-package