diff --git a/.gitea/workflows/deploy-nuxthub.yaml b/.gitea/workflows/deploy-nuxthub.yaml
index ef3984a..77e0c3e 100644
--- a/.gitea/workflows/deploy-nuxthub.yaml
+++ b/.gitea/workflows/deploy-nuxthub.yaml
@@ -5,6 +5,10 @@ on: [push]
 env:
   NUXT_PROJECT_PATH: wp-content/themes/ccat
 
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
   deploy:
     runs-on: ubuntu-websimple