diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 98b582e7..e14b73f8 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -28,6 +28,9 @@ jobs:
   call-workflow-publish:
     needs: release-please
     uses: ./.github/workflows/publish.yml
+    permissions:
+      id-token: write
+      contents: write
     if: ${{ needs.release-please.outputs.releases_created == 'true' }}
     with:
       run_tests: true