diff --git a/.github/workflows/pr-check.yml b/.github/workflows/pr-check.yml
index 0206393..f72f631 100644
--- a/.github/workflows/pr-check.yml
+++ b/.github/workflows/pr-check.yml
@@ -22,6 +22,12 @@ jobs:
   publish-dry-run:
     name: "Validate Package Publishing"
     needs: [codegen]
+    # publish-all's publish-node job needs id-token: write for npm trusted
+    # publishing. A called workflow cannot request more than its caller grants,
+    # and this workflow is capped at contents: read above, so grant it here.
+    permissions:
+      id-token: write
+      contents: read
     uses: ./.github/workflows/publish-all.yml
     secrets: inherit
     with: