diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index c796d12..af1aa3e 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -22,6 +22,9 @@ jobs:
       name: pypi
       url: https://pypi.org/p/geoengine-openapi-client
 
+    permissions:
+        id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
+
     steps:
       - uses: actions/checkout@v3
       - name: Set up Python ${{ matrix.python-version }}