diff --git a/.github/workflows/build-publish.yaml b/.github/workflows/build-publish.yaml
index b2151278..b64418ce 100644
--- a/.github/workflows/build-publish.yaml
+++ b/.github/workflows/build-publish.yaml
@@ -13,6 +13,9 @@ on:
 jobs:
   build-and-publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     env:
       TEST_TAG: ${{ github.repository }}:test
       TEST_CONTAINER_NAME: jbi-healthcheck