diff --git a/.github/chainguard/channel-versions-read.sts.yaml b/.github/chainguard/channel-versions-read.sts.yaml
new file mode 100644
index 00000000000..3bcef2df6ef
--- /dev/null
+++ b/.github/chainguard/channel-versions-read.sts.yaml
@@ -0,0 +1,6 @@
+issuer: https://token.actions.githubusercontent.com
+subject_pattern: repo:warpdotdev/channel-versions:.*
+claim_pattern:
+  job_workflow_ref: warpdotdev/channel-versions/\.github/workflows/(update_channels|create_version_bump_pr)\.yml@.+
+permissions:
+  contents: read