diff --git a/.github/workflows/create_release.yml b/.github/workflows/create_release.yml
index 1ba580cd..3783f4e6 100644
--- a/.github/workflows/create_release.yml
+++ b/.github/workflows/create_release.yml
@@ -17,4 +17,7 @@ jobs:
     needs: [create-release]
     if: ${{ github.event.pull_request.merged == true && startsWith(github.head_ref, 'release/') && github.repository_owner == 'codecov' }}
     uses: ./.github/workflows/release_flow.yml
+    permissions:
+      id-token: write # This is required for requesting the JWT
+      contents: read  # This is required for actions/checkout
     secrets: inherit
\ No newline at end of file