diff --git a/.github/workflows/self-hosted-release.yml b/.github/workflows/self-hosted-release.yml
index 060d8a440..53ee5e3b0 100644
--- a/.github/workflows/self-hosted-release.yml
+++ b/.github/workflows/self-hosted-release.yml
@@ -6,6 +6,10 @@ on:
       - main
     types: [closed]
 
+permissions:
+  contents: 'read'
+  id-token: 'write'
+
 jobs:
   create-release:
     name: Tag Release ${{ github.head_ref }} and Push Docker image to Docker Hub