diff --git a/.github/workflows/canary.yml b/.github/workflows/canary.yml
index 3ad2e8af1..8018055d1 100644
--- a/.github/workflows/canary.yml
+++ b/.github/workflows/canary.yml
@@ -106,6 +106,9 @@ jobs:
   bundle-windows:
     needs: [prepare-version]
     uses: ./.github/workflows/bundle-windows.yml
+    permissions:
+      contents: read
+      id-token: write
     with:
       version: ${{ needs.prepare-version.outputs.version }}
       package_cli: true
@@ -115,6 +118,9 @@ jobs:
   bundle-windows-cuda:
     needs: [prepare-version]
     uses: ./.github/workflows/bundle-windows.yml
+    permissions:
+      contents: read
+      id-token: write
     with:
       version: ${{ needs.prepare-version.outputs.version }}
       package_cli: true