diff --git a/.github/workflows/command-dispatch.yml b/.github/workflows/command-dispatch.yml
index bf921f176cf5..d6c717e88bd7 100644
--- a/.github/workflows/command-dispatch.yml
+++ b/.github/workflows/command-dispatch.yml
@@ -11,8 +11,12 @@ env:
 
 jobs:
   command-dispatch-for-testing:
+    permissions:
+      contents: read
+      id-token: write # For ESC secrets.
     runs-on: ubuntu-latest
     name: command-dispatch-for-testing
+    if: ${{ github.event.issue.pull_request }}
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v4
@@ -34,4 +38,3 @@ jobs:
           permission: write
           issue-type: pull-request
           repository: pulumi/pulumi-azure-native
-    if: ${{ github.event.issue.pull_request }}