diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c6eb11f..071efe6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -74,6 +74,9 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
     needs: [set-variables, docker-build]
+    permissions:
+      contents: "read"
+      id-token: "write"
     environment: stg
     env:
       VERSION: ${{ needs.set-variables.outputs.VERSION }}