diff --git a/.github/workflows/sccache-l0-merge.yml b/.github/workflows/sccache-l0-merge.yml
index 1392a7a..208320e 100644
--- a/.github/workflows/sccache-l0-merge.yml
+++ b/.github/workflows/sccache-l0-merge.yml
@@ -9,6 +9,7 @@ on:
 permissions:
   actions: write
   contents: read
+  id-token: write
 
 # workflow_run is cache-read-only by default. This workflow writes only after
 # trusted push/workflow_dispatch source runs, never pull_request runs.