diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
index 1d6887d4..4121d99b 100644
--- a/.github/workflows/publish-release.yml
+++ b/.github/workflows/publish-release.yml
@@ -12,6 +12,10 @@ jobs:
   run:
     if: startsWith( github.head_ref, 'release/') && (github.event.pull_request.merged == true)
     uses: rokucommunity/workflows/.github/workflows/publish-release.yml@master
+    permissions:
+      id-token: write
+      contents: write
+      pull-requests: write
     with:
       release-type: "npm" # "vsce"
       ref: ${{ github.event.pull_request.merge_commit_sha }}