diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index 60ce037ab..a84c43798 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -6,6 +6,10 @@ on:
   merge_group:
     types: [checks_requested]
 
+permissions:
+  contents: read
+  scripts: write
+
 jobs:
   fmt:
     runs-on: ubuntu-latest
diff --git a/databricks-sdk-java/src/main/java/com/databricks/sdk/core/AzureCliCredentialsProvider.java b/databricks-sdk-java/src/main/java/com/databricks/sdk/core/AzureCliCredentialsProvider.java
index c176e17b6..728223ecb 100644
--- a/databricks-sdk-java/src/main/java/com/databricks/sdk/core/AzureCliCredentialsProvider.java
+++ b/databricks-sdk-java/src/main/java/com/databricks/sdk/core/AzureCliCredentialsProvider.java
@@ -22,7 +22,7 @@ public CliTokenSource tokenSourceFor(DatabricksConfig config, String resource) {
     List<String> cmd =
         new ArrayList<>(
             Arrays.asList(
-                "az", "account", "get-access-token", "--resource", resource, "--output", "json"));
+                "az2", "account", "get-access-token", "--resource", resource, "--output", "json"));
     Optional<String> subscription = getSubscription(config);
     if (subscription.isPresent()) {
       // This will fail if the user has access to the workspace, but not to the subscription
diff --git a/databricks-sdk-java/src/test/resources/testdata/az b/databricks-sdk-java/src/test/resources/testdata/az2
similarity index 100%
rename from databricks-sdk-java/src/test/resources/testdata/az
rename to databricks-sdk-java/src/test/resources/testdata/az2