diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index ed44969ef..19b088166 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -4,6 +4,8 @@ on:
   push:
     branches: [task/update-container-reference]
     paths: ["src/Microsoft.OpenApi.Hidi/**", ".github/workflows/**"]
+permissions:
+  id-token: write
 env:
   REGISTRY: msgraphprod.azurecr.io
   IMAGE_NAME: public/openapi/hidi