diff --git a/.github/workflows/publish-wasm.yml b/.github/workflows/publish-wasm.yml
index 33c5b7c1..0f52478f 100644
--- a/.github/workflows/publish-wasm.yml
+++ b/.github/workflows/publish-wasm.yml
@@ -4,6 +4,11 @@ on:
   push:
     tags:
       - '[0-9]*.[0-9]*.[0-9]*'
+  workflow_dispatch:
+
+permissions:
+  id-token: write
+  contents: read
 
 jobs:
   publish: