diff --git a/.github/workflows/pr-validation.yml b/.github/workflows/pr-validation.yml
index 1438d54..6ada2e4 100644
--- a/.github/workflows/pr-validation.yml
+++ b/.github/workflows/pr-validation.yml
@@ -24,6 +24,8 @@ on:
 
 permissions:
   contents: read
+  id-token: write
+  attestations: write
 
 concurrency:
   group: pr-validation-${{ github.event.pull_request.number || github.ref }}
diff --git a/README.md b/README.md
index 1a6a928..90ddd8f 100644
--- a/README.md
+++ b/README.md
@@ -94,6 +94,7 @@ of production capacity or external service interoperability.
 - [x] fast amd64-first CI with an explicit multiarch amd64+arm64 final gate;
 - [x] tenant-bound DAV ETags and sync tokens;
 - [x] OCI build-provenance attestations generated and verified;
+- [x] pull-request validation delegates the identity-token and attestation permissions required by the provenance gate;
 - [x] log rotation;
 - [x] alerts;
 - [x] Postfix queue visibility;