diff --git a/.github/workflows/deployment.yml b/.github/workflows/deployment.yml
index 0c9e84f9327..90da7143103 100644
--- a/.github/workflows/deployment.yml
+++ b/.github/workflows/deployment.yml
@@ -17,6 +17,10 @@ jobs:
     name: PyPI deployment
     runs-on: "ubuntu-latest"
     if: github.event_name != 'push' || github.repository == 'DIRACGrid/DIRAC'
+    permissions:
+      id-token: write
+      attestations: write
+      contents: read
     defaults:
       run:
         shell: bash -l {0}