diff --git a/.github/workflows/frontend.yaml b/.github/workflows/frontend.yaml
index e894fc30d4..82a261c5dd 100644
--- a/.github/workflows/frontend.yaml
+++ b/.github/workflows/frontend.yaml
@@ -195,6 +195,9 @@ jobs:
           --health-interval 10s
           --health-timeout 5s
           --health-retries 5
+    permissions:
+      contents: read # Required for actions/checkout
+      id-token: write # Required for GitHub OIDC
 
     env:
       COVERAGE: true