diff --git a/.github/workflows/fly.yml b/.github/workflows/fly.yml
index 76f5829..dbebb51 100644
--- a/.github/workflows/fly.yml
+++ b/.github/workflows/fly.yml
@@ -18,6 +18,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  id-token: write # This is required for requesting the JWT
+  contents: read # This is required for actions/checkout
+
 env:
   FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
   AWS_DEFAULT_REGION: us-west-2