diff --git a/.github/workflows/flowzone.yml b/.github/workflows/flowzone.yml
index b7025cc..cfb99e5 100644
--- a/.github/workflows/flowzone.yml
+++ b/.github/workflows/flowzone.yml
@@ -8,6 +8,11 @@ on:
     types: [opened, synchronize, closed]
     branches: [main, master]
 
+permissions:
+  contents: read
+  id-token: "write"  # AWS GitHub OIDC required: write
+  packages: read
+
 jobs:
   flowzone:
     name: Flowzone