diff --git a/.github/workflows/purge-branch.yml b/.github/workflows/purge-branch.yml
index 431e83a1f..3e7541408 100644
--- a/.github/workflows/purge-branch.yml
+++ b/.github/workflows/purge-branch.yml
@@ -7,6 +7,9 @@ jobs:
   purge:
     name: Delete ref from versions API
     uses: ./.github/workflows/versionsapi.yml
+    permissions:
+      id-token: write
+      contents: read
     secrets: inherit
     with:
       command: remove