diff --git a/.github/workflows/build-infra.yaml b/.github/workflows/build-infra.yaml
index 12db972..03afdbe 100644
--- a/.github/workflows/build-infra.yaml
+++ b/.github/workflows/build-infra.yaml
@@ -6,6 +6,11 @@ on:
       - main
   workflow_dispatch: {}
 
+permissions:
+  id-token: write # Needed to modify JWT token for OIDC
+  contents: read # Needed for actions/checkout
+
+
 jobs:
   run:
     name: run