diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index a116b7b..037bae0 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -5,14 +5,15 @@ on:
     tags:
       - "*"
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   build:
     name: Build packages
     runs-on: ubuntu-24.04
     environment: publish
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout
@@ -64,7 +65,6 @@ jobs:
       url: ${{ github.server_url }}/${{ github.repository }}/releases/tag/${{ github.ref_name }}
     permissions:
       contents: write
-      id-token: write
 
     steps:
       - name: Download packages