diff --git a/.github/workflows/sugar_publish.yaml b/.github/workflows/sugar_publish.yaml
index 05cad0e1..48129a39 100644
--- a/.github/workflows/sugar_publish.yaml
+++ b/.github/workflows/sugar_publish.yaml
@@ -95,6 +95,9 @@ jobs:
           files: ./sugar/coverage/lcov.info
 
   publish:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     needs: [test, test-windows, test-macos, test-linux, test-web]
     uses: dart-lang/setup-dart/.github/workflows/publish.yml@v1
     with: