diff --git a/.github/workflows/publish-go-nightly-task.yml b/.github/workflows/publish-go-nightly-task.yml
index 8b496a6fbe8..d2efb3d92b5 100644
--- a/.github/workflows/publish-go-nightly-task.yml
+++ b/.github/workflows/publish-go-nightly-task.yml
@@ -236,6 +236,9 @@ jobs:
       - create-nightly-artifacts
       - notarize-macos
       - create-windows-installer
+    permissions:
+      contents: write
+      id-token: write # This is required for requesting the JWT
 
     steps:
       - name: Checkout repository
diff --git a/.github/workflows/release-go-task.yml b/.github/workflows/release-go-task.yml
index f24caab458c..e43b3252155 100644
--- a/.github/workflows/release-go-task.yml
+++ b/.github/workflows/release-go-task.yml
@@ -16,10 +16,6 @@ on:
     tags:
       - "v[0-9]+.[0-9]+.[0-9]+*"
 
-permissions:
-  id-token: write # This is required for requesting the JWT
-  contents: read # This is required for actions/checkout
-
 jobs:
   create-release-artifacts:
     outputs:
@@ -242,6 +238,7 @@ jobs:
       - create-windows-installer
     permissions:
       contents: write
+      id-token: write # This is required for requesting the JWT
 
     steps:
       - name: Checkout repository