diff --git a/.github/workflows/ci_compliance.yml b/.github/workflows/ci_compliance.yml
index 83e842b4ea9..36fc0ec5e9f 100644
--- a/.github/workflows/ci_compliance.yml
+++ b/.github/workflows/ci_compliance.yml
@@ -9,6 +9,10 @@ on:
     types: [checks_requested]
     branches: [main]
 
+permissions:
+  contents: read  # This is required for actions/checkout
+  id-token: write # This is required for requesting the JWT/OIDC
+
 jobs:
   duvet:
     runs-on: ubuntu-latest