diff --git a/.github/workflows/hydrun.yaml b/.github/workflows/hydrun.yaml
index ef8362d..0f6a60a 100644
--- a/.github/workflows/hydrun.yaml
+++ b/.github/workflows/hydrun.yaml
@@ -1,5 +1,7 @@
 name: hydrun CI
 
+permissions: write-all # Necessary for the generate-build-provenance action
+
 on:
   push:
   pull_request:
@@ -68,7 +70,6 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
-      id-token: write
     needs: build-linux
 
     steps: