diff --git a/.github/workflows/sync.yml b/.github/workflows/sync.yml
index 74a6f1241..c46eead3e 100644
--- a/.github/workflows/sync.yml
+++ b/.github/workflows/sync.yml
@@ -5,6 +5,12 @@ on:
     branches:
       - main
 
+permissions:
+  id-token: write # This is required for requesting the JWT
+  contents: write
+  issues: write
+  security-events: read
+  
 jobs:
   sync-branch:
     name: Update generator-update branch