diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2de8d3a..7b7a63c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -30,6 +30,12 @@ on:
 jobs:
   check:
     uses: cidverse/catalog/.github/workflows/shared-ci.yml@main
+    permissions:
+      contents: write # create release
+      packages: write # publish packages
+      security-events: write # sarif reports
+      pages: write # pages
+      id-token: write # signing
     with:
       cid-workflow: main
       cid-version: latest