diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml
index 8aa7069..7768b75 100644
--- a/.github/workflows/python-publish.yml
+++ b/.github/workflows/python-publish.yml
@@ -13,7 +13,10 @@ on:
     types: [published]
 
 permissions:
+  # Required for actions/checkout
   contents: read
+  # Required for OIDC authentication to PyPI
+  id-token: write
 
 jobs:
   deploy: