fix: permissions for update