diff --git a/.github/workflows/build-and-deploy.yml b/.github/workflows/build-and-deploy.yml
index 08676954..704255b2 100644
--- a/.github/workflows/build-and-deploy.yml
+++ b/.github/workflows/build-and-deploy.yml
@@ -65,6 +65,9 @@ jobs:
     deploy_dev_gcp:
         if: github.event.inputs.cluster == 'dev-gcp' || github.event_name == 'push'
         needs: bygg
+        permissions:
+            contents: read
+            id-token: write
         runs-on: ubuntu-latest
         timeout-minutes: 30
         environment: dev-gcp:aap
@@ -81,6 +84,9 @@ jobs:
     deploy_prod_gcp:
         if: github.event.inputs.cluster == 'prod-gcp'
         needs: bygg
+        permissions:
+            contents: read
+            id-token: write
         runs-on: ubuntu-latest
         timeout-minutes: 30
         environment: prod-gcp:aap