diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 6b1579235..7341daf9f 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -5,6 +5,10 @@ on:
     tags:
       - 'v*'
 
+permissions:
+  id-token: write # This is required for requesting the JWT
+  contents: read  # This is required for actions/checkout
+
 jobs:
   release-conda-store:
     name: 'PyPi Release conda-store-server'