diff --git a/.github/workflows/release-bazel.yml b/.github/workflows/release-bazel.yml
index 16a0fcfc..9b88eb31 100644
--- a/.github/workflows/release-bazel.yml
+++ b/.github/workflows/release-bazel.yml
@@ -35,8 +35,6 @@ jobs:
       attest: false # too hard to generate the intoto.jsonl file
     permissions:
       contents: write
-      id-token: write
-      attestations: write
     secrets:
       # Necessary to push to the BCR fork, and to open a pull request against a registry
       publish_token: ${{ secrets.BCR_PUBLISH_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fd803d4c..60cd64aa 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -44,7 +44,5 @@ jobs:
       tag_name: ${{ github.ref_name }}
     permissions:
       contents: write
-      id-token: write
-      attestations: write
     secrets:
       BCR_PUBLISH_TOKEN: ${{ secrets.BCR_PUBLISH_TOKEN }}