diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index ff8514b2a..22e112cfa 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -11,6 +11,10 @@ on:
 jobs:
   deploy-static:
 
+    permissions:
+      contents: 'read'
+      id-token: 'write'
+
     runs-on: ubuntu-latest
 
     steps: