diff --git a/.github/workflows/build-publish.yml b/.github/workflows/build-publish.yml
index f1958c4..2581d3d 100644
--- a/.github/workflows/build-publish.yml
+++ b/.github/workflows/build-publish.yml
@@ -48,6 +48,9 @@ jobs:
 
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     needs:
     - build-wheels
     if: github.event_name == 'release' && github.event.action == 'published' && github.event.release.prerelease == false