diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 15be11fd75a..3a328afbd8a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,6 +24,7 @@ permissions:
   pull-requests: write # needed by lint (PR comment) + supply-chain review_status
   actions: read # needed by osv-scanner (SARIF upload)
   security-events: write # needed by osv-scanner (SARIF upload)
+  id-token: write # needed by docker.yml (WIF -> Artifact Registry buildx cache)
   packages: write # needed by docker build
 
 concurrency: