diff --git a/.github/workflows/publish-application-packages.yml b/.github/workflows/publish-application-packages.yml
index d8e1c34d05..680fd2eee4 100644
--- a/.github/workflows/publish-application-packages.yml
+++ b/.github/workflows/publish-application-packages.yml
@@ -1,7 +1,6 @@
 name: Zarf Application Package Publishing
 
 permissions:
-  id-token: write
   contents: read
 
 on:
@@ -11,6 +10,7 @@ jobs:
   publish-packages:
     runs-on: ubuntu-latest
     permissions:
+      id-token: write
       packages: write
     steps:
       - name: "Checkout Repo"