diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 174b8ef..1c88e8a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -91,6 +91,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      id-token: write  # required for provenance
       packages: write
     strategy:
       fail-fast: false