diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 72814e5ba25..b1dd0720408 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,6 +16,10 @@ concurrency:
   group: "${{ github.ref_name }}-${{ github.head_ref }}"
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
 
   get-image-tag: