diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 10d565b..592503a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -64,6 +64,9 @@ jobs:
 
     name: ${{ matrix.name }}
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -80,4 +83,4 @@ jobs:
       - uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6
         if: ${{ matrix.coverage }}
         with:
-          token: ${{ secrets.CODECOV_TOKEN }}
+          use_oidc: true