diff --git a/.github/workflows/publish-package.yaml b/.github/workflows/publish-package.yaml
index 0277ba8..eed72f8 100644
--- a/.github/workflows/publish-package.yaml
+++ b/.github/workflows/publish-package.yaml
@@ -3,6 +3,9 @@ on:
   push:
     branches:
       - main
+permissions:
+  contents: 'read'
+  id-token: 'write'
 jobs:
   main:
     if: "contains(github.event.head_commit.message, 'publish:')"