diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index 46690dd..bbe5d04 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -10,7 +10,11 @@ on:
   pull_request:
     branches: [ "main" ]
 
-permissions: read-all
+permissions:
+  contents: read
+  packages: write
+  attestations: write
+  id-token: write
 
 jobs:
   build: