diff --git a/.github/workflows/claude-pr-review.yml b/.github/workflows/claude-pr-review.yml
index 5f7e19c..26320f2 100644
--- a/.github/workflows/claude-pr-review.yml
+++ b/.github/workflows/claude-pr-review.yml
@@ -12,6 +12,7 @@ on:
 permissions:
   contents: read
   pull-requests: write
+  id-token: write # required: the action authenticates to GitHub via OIDC
 
 jobs:
   review:
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index d123a0e..f8863af 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -14,6 +14,7 @@ permissions:
   contents: read
   pull-requests: write
   issues: write
+  id-token: write # required: the action authenticates to GitHub via OIDC
 
 jobs:
   claude: