diff --git a/.github/workflows/cli.yml b/.github/workflows/cli.yml
index db7ca0f57..a675f9f25 100644
--- a/.github/workflows/cli.yml
+++ b/.github/workflows/cli.yml
@@ -24,6 +24,8 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      id-token: write
+      packages: write
     defaults:
       run:
         working-directory: ./cli
@@ -59,8 +61,6 @@ jobs:
       - run: pnpm build
       - run: pnpm publish --no-git-checks
         if: ${{ github.event_name == 'release' }}
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
   docker:
     name: Docker
diff --git a/.github/workflows/sdk.yml b/.github/workflows/sdk.yml
index 2446b5ffc..99e6ba2e1 100644
--- a/.github/workflows/sdk.yml
+++ b/.github/workflows/sdk.yml
@@ -12,6 +12,8 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      id-token: write
+      packages: write
     defaults:
       run:
         working-directory: ./open-api/typescript-sdk
@@ -43,5 +45,3 @@ jobs:
         run: pnpm build
       - name: Publish
         run: pnpm publish --no-git-checks
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}