diff --git a/.github/workflows/create-or-promote-release.yml b/.github/workflows/create-or-promote-release.yml
index 8fbf5829f..2787fbcfa 100644
--- a/.github/workflows/create-or-promote-release.yml
+++ b/.github/workflows/create-or-promote-release.yml
@@ -23,6 +23,9 @@ on:
 
 permissions:
   contents: write
+  pull-requests: read
+  id-token: write
+  attestations: write
 
 jobs:
   create-tag: