diff --git a/.github/workflows/deploy-ec2.yml b/.github/workflows/deploy-ec2.yml
index 43fb1887..9c3b5b02 100644
--- a/.github/workflows/deploy-ec2.yml
+++ b/.github/workflows/deploy-ec2.yml
@@ -11,6 +11,10 @@ concurrency:
   group: deploy-ec2
   cancel-in-progress: false
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   deploy:
     if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success'