diff --git a/.github/workflows/sub-cloudrun-deploy.yml b/.github/workflows/sub-cloudrun-deploy.yml
index f7b62d5..d1636be 100644
--- a/.github/workflows/sub-cloudrun-deploy.yml
+++ b/.github/workflows/sub-cloudrun-deploy.yml
@@ -68,6 +68,9 @@ jobs:
     environment:
       name: ${{ inputs.environment }}
       url: ${{ steps.deploy.outputs.url }}
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     steps:
       - name: Inject slug/short variables
         uses: rlespinasse/github-slug-action@v4.4.1