diff --git a/.github/workflows/build-extension.yml b/.github/workflows/build-extension.yml
index c0fb043..4f12a66 100644
--- a/.github/workflows/build-extension.yml
+++ b/.github/workflows/build-extension.yml
@@ -10,6 +10,9 @@ on:
 
 jobs:
   build:
+    permissions:
+     contents: 'read'
+     id-token: 'write'
     runs-on: windows-latest
     if: |
       (github.event_name == 'push' && github.ref_type == 'branch') ||