diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 119d1f8..5d8a8fb 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -6,6 +6,9 @@ on:
       - '*'
 jobs:
   build-linux:
+    permissions:
+      id-token: write # This is required for requesting the JWT
+      contents: read  # This is required for actions/checkout
     name: Publish Binaries
     runs-on: ubuntu-latest