diff --git a/.github/workflows/publish-wasm.yml b/.github/workflows/publish-wasm.yml
index 33c5b7c1..e87d034b 100644
--- a/.github/workflows/publish-wasm.yml
+++ b/.github/workflows/publish-wasm.yml
@@ -5,6 +5,10 @@ on:
     tags:
       - '[0-9]*.[0-9]*.[0-9]*'
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   publish:
     name: Publish MuJoCo WASM package