specify better suited permissions

- also fix an embarrassing typo ^^

[ci skip]