diff --git a/.gitea/workflows/analysis.yml b/.gitea/workflows/analysis.yml
index fb36950..dcaba65 100644
--- a/.gitea/workflows/analysis.yml
+++ b/.gitea/workflows/analysis.yml
@@ -2,8 +2,9 @@ on: [push]
 
 jobs:
   build:
-    env:
-      RUNNER_TOOL_CACHE: /toolcache
+    permissions:
+      contents: read
+      id-token: write
     name: Build Nix targets
     runs-on: ubuntu-22.04
     steps:
diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 292a17c..d05b5f4 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -6,8 +6,9 @@ on:
 
 jobs:
   build:
-    env:
-      RUNNER_TOOL_CACHE: /toolcache
+    permissions:
+      contents: read
+      id-token: write
     name: build hive configuration
     runs-on: ubuntu-22.04
     steps: