diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 2c46a215f..fc5360b31 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -213,6 +213,11 @@ jobs:
           category: ${{ matrix.flavor }}
   build-core-uki:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write  # OIDC support
+      contents: write
+      actions: read
+      security-events: write
     needs:
       - get-uki-matrix
     strategy: