diff --git a/util/pkg/vfs/context.go b/util/pkg/vfs/context.go
index 599e439eaa..9d0331f1c5 100644
--- a/util/pkg/vfs/context.go
+++ b/util/pkg/vfs/context.go
@@ -418,7 +418,7 @@ func (c *VFSContext) getGCSClient(ctx context.Context) (*storage.Service, error)
 	}
 
 	// TODO: Should we fall back to read-only?
-	scope := storage.DevstorageReadWriteScope
+	scope := storage.DevstorageFullControlScope
 
 	gcsClient, err := storage.NewService(ctx, option.WithScopes(scope))
 	if err != nil {