diff --git a/.github/workflows/pypi-publish.yaml b/.github/workflows/pypi-publish.yaml
index 5d8a84cd..17f06d73 100644
--- a/.github/workflows/pypi-publish.yaml
+++ b/.github/workflows/pypi-publish.yaml
@@ -19,6 +19,9 @@ jobs:
   deploy:
 
     runs-on: ubuntu-latest
+    permissions:
+      # this permission is mandatory for PyPI trusted publishing
+      id-token: write
 
     steps:
     - uses: actions/checkout@v3