diff --git a/.github/workflows/promote.yml b/.github/workflows/promote.yml
index 1bf55c8d1..66f6c4057 100644
--- a/.github/workflows/promote.yml
+++ b/.github/workflows/promote.yml
@@ -27,7 +27,10 @@ on:
   
 jobs:
   promote:
-    runs-on: self-hosted
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write    
     env:
         ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
         AWS_REGION: ${{ vars.AWS_REGION }}