diff --git a/.github/chainguard/self.release.create-release.sts.yaml b/.github/chainguard/self.release.create-release.sts.yaml
new file mode 100644
index 0000000..97173d3
--- /dev/null
+++ b/.github/chainguard/self.release.create-release.sts.yaml
@@ -0,0 +1,10 @@
+issuer: https://token.actions.githubusercontent.com
+
+subject_pattern: "repo:DataDog/sirun:ref:refs/tags/v.*"
+
+claim_pattern:
+  event_name: "push"
+  job_workflow_ref: DataDog/sirun/\.github/workflows/release\.yml@refs/tags/v.*
+
+permissions:
+  contents: write
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d7816ff..74dfbad 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -6,11 +6,18 @@ on:
 jobs:
   create-release:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
+      - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
+        id: octo-sts
+        with:
+          scope: DataDog/sirun
+          policy: self.release.create-release
       - uses: actions/checkout@v2
       - uses: taiki-e/create-gh-release-action@v1
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }}
   upload-assets:
     strategy:
       matrix:
@@ -22,7 +29,14 @@ jobs:
           - target: aarch64-apple-darwin
             os: macos-latest
     runs-on: ${{ matrix.os || 'ubuntu-latest'}}
+    permissions:
+      id-token: write
     steps:
+      - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
+        id: octo-sts
+        with:
+          scope: DataDog/sirun
+          policy: self.release.create-release
       - uses: actions/checkout@v2
       - uses: taiki-e/upload-rust-binary-action@v1
         with:
@@ -30,5 +44,5 @@ jobs:
           target: ${{ matrix.target }}
           archive: $bin-$tag-$target
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }}
           CARGO_PROFILE_RELEASE_LTO: true