diff --git a/.github/actions/prepare_environment/action.yml b/.github/actions/prepare_environment/action.yml
index da52366951a..18c7697f8fc 100644
--- a/.github/actions/prepare_environment/action.yml
+++ b/.github/actions/prepare_environment/action.yml
@@ -15,8 +15,8 @@ inputs:
     description: If true, dependencies needed for building release artifacts will be installed (e.g., cargo-about for license generation).
   cache_key:
     description: If set, the cache key to use.  If unset, the cache key will be derived from the target OS.
-  ssh_key:
-    description: SSH private key used to clone the private warp-channel-config repository. Only consumed when running in warpdotdev/warp-internal.
+  install_channel_config:
+    description: If true, mint a read token for the private warp-channel-config repository so the channel config generator can be installed. Only honored when running in warpdotdev/warp-internal.
 
 runs:
   using: composite
@@ -97,14 +97,27 @@ runs:
         cd "${{ steps.repo-root.outputs.path }}"
         ./script/install_cargo_binstall
 
-    # Load the SSH key needed to clone the private warp-channel-config repo. Only
-    # run in warpdotdev/warp-internal; elsewhere (mirrors, fork PRs) this is a no-op
-    # and install_channel_config falls back gracefully.
-    - name: Setup SSH keys for warp-channel-config
-      if: ${{ github.repository == 'warpdotdev/warp-internal' && inputs.ssh_key != '' }}
-      uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
+    # The channel config generator lives in a private repo that install_channel_config fetches
+    # over an SSH URL. Only warpdotdev/warp-internal can mint a token for it; elsewhere (mirrors,
+    # fork PRs) these steps are skipped and install_channel_config falls back gracefully.
+    - name: Mint warp-channel-config token
+      if: ${{ github.repository == 'warpdotdev/warp-internal' && inputs.install_channel_config == 'true' }}
+      id: channel_config_token
+      uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1
       with:
-        ssh-private-key: ${{ inputs.ssh_key }}
+        scope: warpdotdev/warp-channel-config
+        identity: warp-internal-release
+
+    # Rewrite the SSH URL to HTTPS with the minted token. cargo only honors git URL rewrites when
+    # it shells out to the git CLI, so turn that on for the rest of the job.
+    - name: Route warp-channel-config fetches through the minted token
+      if: ${{ steps.channel_config_token.outputs.token != '' }}
+      shell: bash
+      env:
+        CHANNEL_CONFIG_TOKEN: ${{ steps.channel_config_token.outputs.token }}
+      run: |
+        git config --global "url.https://x-access-token:${CHANNEL_CONFIG_TOKEN}@github.com/warpdotdev/warp-channel-config.insteadOf" "ssh://git@github.com/warpdotdev/warp-channel-config"
+        echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV"
 
     - uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1.7.0
       if: ${{ inputs.target_os == 'macos' && inputs.is_self_hosted != 'true' }}
diff --git a/.github/chainguard/release-changelog.sts.yaml b/.github/chainguard/release-changelog.sts.yaml
new file mode 100644
index 00000000000..42acd0658d9
--- /dev/null
+++ b/.github/chainguard/release-changelog.sts.yaml
@@ -0,0 +1,7 @@
+issuer: https://token.actions.githubusercontent.com
+subject_pattern: repo:warpdotdev/warp-internal:.*
+claim_pattern:
+  job_workflow_ref: warpdotdev/warp-internal/\.github/workflows/create_release\.yml@.+
+permissions:
+  contents: read
+  pull_requests: read
diff --git a/.github/workflows/create_release.yml b/.github/workflows/create_release.yml
index f8215e24feb..0b242947f77 100644
--- a/.github/workflows/create_release.yml
+++ b/.github/workflows/create_release.yml
@@ -59,6 +59,7 @@ on:
 
 permissions:
   contents: write # script/create_release_tag_and_branch pushes the release branch and tag; softprops/action-gh-release creates the GitHub release; each build job runs `gh release upload` to attach its artifacts
+  id-token: write # google-github-actions/auth federates the job's OIDC token to GCP for release uploads; octo-sts/action exchanges it for scoped GitHub tokens
 
 env:
   CARGO_TERM_COLOR: always
@@ -163,7 +164,7 @@ jobs:
           is_self_hosted: false
           ref: ${{ needs.prepare_release.outputs.release_branch }}
           install_release_deps: true
-          ssh_key: ${{ secrets.WARP_CHANNEL_CONFIG_ACCESS_SSH_KEY }}
+          install_channel_config: true
 
       - name: Ensure rust target is installed
         run: rustup target add ${{ matrix.arch }}-apple-darwin
@@ -220,7 +221,8 @@ jobs:
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
         if: ${{ needs.prepare_release.outputs.should_publish == 'true' }}
         with:
-          credentials_json: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
+          workload_identity_provider: projects/643991131484/locations/global/workloadIdentityPools/github-actions/providers/warp-terraform
+          service_account: github-actions@astral-field-294621.iam.gserviceaccount.com
 
       - name: Upload DMG to Google Cloud Storage
         if: ${{ needs.prepare_release.outputs.should_publish == 'true' }}
@@ -291,7 +293,7 @@ jobs:
           is_self_hosted: false
           ref: ${{ needs.prepare_release.outputs.release_branch }}
           install_release_deps: true
-          ssh_key: ${{ secrets.WARP_CHANNEL_CONFIG_ACCESS_SSH_KEY }}
+          install_channel_config: true
 
       # Install go toolchain, which is needed for bundling a pprof binary.
       - name: Setup Go
@@ -414,7 +416,8 @@ jobs:
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
         if: ${{ needs.prepare_release.outputs.should_publish == 'true' }}
         with:
-          credentials_json: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
+          workload_identity_provider: projects/643991131484/locations/global/workloadIdentityPools/github-actions/providers/warp-terraform
+          service_account: github-actions@astral-field-294621.iam.gserviceaccount.com
 
       - name: Upload DMG to Google Cloud Storage
         if: ${{ needs.prepare_release.outputs.should_publish == 'true' }}
@@ -457,7 +460,7 @@ jobs:
           is_self_hosted: false
           ref: ${{ needs.prepare_release.outputs.release_branch }}
           install_release_deps: true
-          ssh_key: ${{ secrets.WARP_CHANNEL_CONFIG_ACCESS_SSH_KEY }}
+          install_channel_config: true
 
       - name: Ensure rust target is installed
         run: rustup target add ${{ matrix.arch }}-apple-darwin
@@ -540,7 +543,7 @@ jobs:
           is_self_hosted: false
           ref: ${{ needs.prepare_release.outputs.release_branch }}
           install_release_deps: true
-          ssh_key: ${{ secrets.WARP_CHANNEL_CONFIG_ACCESS_SSH_KEY }}
+          install_channel_config: true
 
       - name: Get channel configuration
         id: get-config
@@ -594,7 +597,8 @@ jobs:
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
         if: ${{ needs.prepare_release.outputs.should_publish == 'true' }}
         with:
-          credentials_json: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
+          workload_identity_provider: projects/643991131484/locations/global/workloadIdentityPools/github-actions/providers/warp-terraform
+          service_account: github-actions@astral-field-294621.iam.gserviceaccount.com
 
       - name: Upload CLI to Google Cloud Storage
         if: ${{ needs.prepare_release.outputs.should_publish == 'true' }}
@@ -650,7 +654,7 @@ jobs:
           is_self_hosted: false
           ref: ${{ needs.prepare_release.outputs.release_branch }}
           install_release_deps: true
-          ssh_key: ${{ secrets.WARP_CHANNEL_CONFIG_ACCESS_SSH_KEY }}
+          install_channel_config: true
 
       - name: Ensure rust target is installed
         run: rustup target add ${{ matrix.arch }}-apple-darwin
@@ -733,7 +737,7 @@ jobs:
           is_self_hosted: false
           ref: ${{ needs.prepare_release.outputs.release_branch }}
           install_release_deps: true
-          ssh_key: ${{ secrets.WARP_CHANNEL_CONFIG_ACCESS_SSH_KEY }}
+          install_channel_config: true
 
       - name: Get channel configuration
         id: get-config
@@ -814,7 +818,8 @@ jobs:
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
         if: ${{ needs.prepare_release.outputs.should_publish == 'true' }}
         with:
-          credentials_json: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
+          workload_identity_provider: projects/643991131484/locations/global/workloadIdentityPools/github-actions/providers/warp-terraform
+          service_account: github-actions@astral-field-294621.iam.gserviceaccount.com
 
       - name: Upload TUI to Google Cloud Storage
         if: ${{ needs.prepare_release.outputs.should_publish == 'true' }}
@@ -856,7 +861,7 @@ jobs:
           is_self_hosted: false
           ref: ${{ needs.prepare_release.outputs.release_branch }}
           install_release_deps: true
-          ssh_key: ${{ secrets.WARP_CHANNEL_CONFIG_ACCESS_SSH_KEY }}
+          install_channel_config: true
 
       # Install gcc 10, as gcc 9.5 has a bug with memcmp that is incompatible
       # with aws-lc-rs (see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95189).
@@ -943,7 +948,7 @@ jobs:
           is_self_hosted: false
           ref: ${{ needs.prepare_release.outputs.release_branch }}
           install_release_deps: true
-          ssh_key: ${{ secrets.WARP_CHANNEL_CONFIG_ACCESS_SSH_KEY }}
+          install_channel_config: true
 
       # Install gcc 10, as gcc 9.5 has a bug with memcmp that is incompatible
       # with aws-lc-rs (see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95189).
@@ -1027,7 +1032,8 @@ jobs:
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
         if: ${{ needs.prepare_release.outputs.should_publish == 'true' }}
         with:
-          credentials_json: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
+          workload_identity_provider: projects/643991131484/locations/global/workloadIdentityPools/github-actions/providers/warp-terraform
+          service_account: github-actions@astral-field-294621.iam.gserviceaccount.com
 
       - name: Upload TUI to Google Cloud Storage
         if: ${{ needs.prepare_release.outputs.should_publish == 'true' }}
@@ -1066,7 +1072,7 @@ jobs:
           is_self_hosted: false
           ref: ${{ needs.prepare_release.outputs.release_branch }}
           install_release_deps: true
-          ssh_key: ${{ secrets.WARP_CHANNEL_CONFIG_ACCESS_SSH_KEY }}
+          install_channel_config: true
 
       # Install gcc 10, as gcc 9.5 has a bug with memcmp that is incompatible
       # with aws-lc-rs (see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95189).
@@ -1087,7 +1093,8 @@ jobs:
 
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
         with:
-          credentials_json: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
+          workload_identity_provider: projects/643991131484/locations/global/workloadIdentityPools/github-actions/providers/warp-terraform
+          service_account: github-actions@astral-field-294621.iam.gserviceaccount.com
 
       - name: Install linuxdeploy
         run: script/linux/install_linuxdeploy
@@ -1228,7 +1235,7 @@ jobs:
           is_self_hosted: false
           ref: ${{ needs.prepare_release.outputs.release_branch }}
           install_release_deps: true
-          ssh_key: ${{ secrets.WARP_CHANNEL_CONFIG_ACCESS_SSH_KEY }}
+          install_channel_config: true
 
       # Install gcc 10, as gcc 9.5 has a bug with memcmp that is incompatible
       # with aws-lc-rs (see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95189).
@@ -1309,7 +1316,7 @@ jobs:
           is_self_hosted: false
           ref: ${{ needs.prepare_release.outputs.release_branch }}
           install_release_deps: true
-          ssh_key: ${{ secrets.WARP_CHANNEL_CONFIG_ACCESS_SSH_KEY }}
+          install_channel_config: true
 
       # Install gcc 10, as gcc 9.5 has a bug with memcmp that is incompatible
       # with aws-lc-rs (see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95189).
@@ -1330,7 +1337,8 @@ jobs:
 
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
         with:
-          credentials_json: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
+          workload_identity_provider: projects/643991131484/locations/global/workloadIdentityPools/github-actions/providers/warp-terraform
+          service_account: github-actions@astral-field-294621.iam.gserviceaccount.com
 
       - name: Load PGP signing key and passphrase
         run: |
@@ -1506,7 +1514,7 @@ jobs:
           is_self_hosted: false
           ref: ${{ needs.prepare_release.outputs.release_branch }}
           install_release_deps: true
-          ssh_key: ${{ secrets.WARP_CHANNEL_CONFIG_ACCESS_SSH_KEY }}
+          install_channel_config: true
 
       # Install gcc 10, as gcc 9.5 has a bug with memcmp that is incompatible
       # with aws-lc-rs (see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95189).
@@ -1538,7 +1546,8 @@ jobs:
 
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
         with:
-          credentials_json: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
+          workload_identity_provider: projects/643991131484/locations/global/workloadIdentityPools/github-actions/providers/warp-terraform
+          service_account: github-actions@astral-field-294621.iam.gserviceaccount.com
 
       - name: Install linuxdeploy
         run: script/linux/install_linuxdeploy
@@ -1597,7 +1606,7 @@ jobs:
           is_self_hosted: false
           ref: ${{ needs.prepare_release.outputs.release_branch }}
           install_release_deps: true
-          ssh_key: ${{ secrets.WARP_CHANNEL_CONFIG_ACCESS_SSH_KEY }}
+          install_channel_config: true
 
       # Install gcc 10, as gcc 9.5 has a bug with memcmp that is incompatible
       # with aws-lc-rs (see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95189).
@@ -1618,7 +1627,8 @@ jobs:
 
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
         with:
-          credentials_json: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
+          workload_identity_provider: projects/643991131484/locations/global/workloadIdentityPools/github-actions/providers/warp-terraform
+          service_account: github-actions@astral-field-294621.iam.gserviceaccount.com
 
       # Namespace's User Bundled Cache persists target/ between jobs on the same profile, which can
       # leave stale packages from a previous channel's build in the linux bundle output dir.
@@ -1691,7 +1701,8 @@ jobs:
 
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
         with:
-          credentials_json: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
+          workload_identity_provider: projects/643991131484/locations/global/workloadIdentityPools/github-actions/providers/warp-terraform
+          service_account: github-actions@astral-field-294621.iam.gserviceaccount.com
       
       - name: Set up Sentry CLI
         if: ${{ needs.prepare_release.outputs.should_publish == 'true' }}
@@ -1947,7 +1958,7 @@ jobs:
           target_os: wasm
           is_self_hosted: false
           ref: ${{ needs.prepare_release.outputs.release_branch }}
-          ssh_key: ${{ secrets.WARP_CHANNEL_CONFIG_ACCESS_SSH_KEY }}
+          install_channel_config: true
 
       - name: Get channel configuration
         id: get-config
@@ -2003,7 +2014,8 @@ jobs:
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
         if: ${{ needs.prepare_release.outputs.should_publish == 'true' }}
         with:
-          credentials_json: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
+          workload_identity_provider: projects/643991131484/locations/global/workloadIdentityPools/github-actions/providers/warp-terraform
+          service_account: github-actions@astral-field-294621.iam.gserviceaccount.com
 
       - name: Upload packages to Google Cloud Storage
         if: ${{ needs.prepare_release.outputs.should_publish == 'true' }}
@@ -2073,7 +2085,7 @@ jobs:
           is_self_hosted: false
           ref: ${{ needs.prepare_release.outputs.release_branch }}
           install_release_deps: true
-          ssh_key: ${{ secrets.WARP_CHANNEL_CONFIG_ACCESS_SSH_KEY }}
+          install_channel_config: true
 
       - name: Get channel configuration
         id: get-config
@@ -2149,7 +2161,7 @@ jobs:
           is_self_hosted: false
           ref: ${{ needs.prepare_release.outputs.release_branch }}
           install_release_deps: true
-          ssh_key: ${{ secrets.WARP_CHANNEL_CONFIG_ACCESS_SSH_KEY }}
+          install_channel_config: true
 
       - name: Get channel configuration
         id: get-config
@@ -2235,7 +2247,8 @@ jobs:
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
         if: ${{ needs.prepare_release.outputs.should_publish == 'true' }}
         with:
-          credentials_json: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
+          workload_identity_provider: projects/643991131484/locations/global/workloadIdentityPools/github-actions/providers/warp-terraform
+          service_account: github-actions@astral-field-294621.iam.gserviceaccount.com
 
       - name: Upload TUI installer to Google Cloud Storage
         if: ${{ needs.prepare_release.outputs.should_publish == 'true' }}
@@ -2296,7 +2309,7 @@ jobs:
           is_self_hosted: false
           ref: ${{ needs.prepare_release.outputs.release_branch }}
           install_release_deps: true
-          ssh_key: ${{ secrets.WARP_CHANNEL_CONFIG_ACCESS_SSH_KEY }}
+          install_channel_config: true
 
       - name: Get channel configuration
         id: get-config
@@ -2378,7 +2391,7 @@ jobs:
           is_self_hosted: false
           ref: ${{ needs.prepare_release.outputs.release_branch }}
           install_release_deps: true
-          ssh_key: ${{ secrets.WARP_CHANNEL_CONFIG_ACCESS_SSH_KEY }}
+          install_channel_config: true
 
       - name: Get channel configuration
         id: get-config
@@ -2487,7 +2500,8 @@ jobs:
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
         if: ${{ needs.prepare_release.outputs.should_publish == 'true' }}
         with:
-          credentials_json: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
+          workload_identity_provider: projects/643991131484/locations/global/workloadIdentityPools/github-actions/providers/warp-terraform
+          service_account: github-actions@astral-field-294621.iam.gserviceaccount.com
 
       - name: Upload CLI to Google Cloud Storage
         if: ${{ needs.prepare_release.outputs.should_publish == 'true' }}
@@ -2561,7 +2575,7 @@ jobs:
           is_self_hosted: false
           ref: ${{ needs.prepare_release.outputs.release_branch }}
           install_release_deps: true
-          ssh_key: ${{ secrets.WARP_CHANNEL_CONFIG_ACCESS_SSH_KEY }}
+          install_channel_config: true
 
       - name: Get channel configuration
         id: get-config
@@ -2635,7 +2649,7 @@ jobs:
           is_self_hosted: false
           ref: ${{ needs.prepare_release.outputs.release_branch }}
           install_release_deps: true
-          ssh_key: ${{ secrets.WARP_CHANNEL_CONFIG_ACCESS_SSH_KEY }}
+          install_channel_config: true
 
       - name: Get channel configuration
         id: get-config
@@ -2750,7 +2764,8 @@ jobs:
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
         if: ${{ needs.prepare_release.outputs.should_publish == 'true' }}
         with:
-          credentials_json: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
+          workload_identity_provider: projects/643991131484/locations/global/workloadIdentityPools/github-actions/providers/warp-terraform
+          service_account: github-actions@astral-field-294621.iam.gserviceaccount.com
 
       - name: Upload installer to Google Cloud Storage
         if: ${{ needs.prepare_release.outputs.should_publish == 'true' }}
@@ -2963,13 +2978,13 @@ jobs:
             --input "${{ runner.temp }}/changelog-draft/changelog-draft.json" \
             --output "${{ runner.temp }}/changelog-draft/changelog-release.json"
 
-      - name: Obtain a GitHub App Installation Access Token (non-stable only)
+      - name: Mint release-changelog token (non-stable only)
         if: inputs.channel != 'stable'
         id: github_app_auth
-        run: |
-          TOKEN="$(npx obtain-github-app-installation-access-token ci ${{ secrets.GH_APP_CREDENTIALS_TOKEN }})"
-          echo "::add-mask::$TOKEN"
-          echo "token=$TOKEN" >> $GITHUB_OUTPUT
+        uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1
+        with:
+          scope: warpdotdev/warp-internal
+          identity: release-changelog
 
       - name: Generate changelog via legacy action (non-stable only)
         if: inputs.channel != 'stable'
@@ -3090,7 +3105,8 @@ jobs:
 
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
         with:
-          credentials_json: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
+          workload_identity_provider: projects/643991131484/locations/global/workloadIdentityPools/github-actions/providers/warp-terraform
+          service_account: github-actions@astral-field-294621.iam.gserviceaccount.com
 
       - name: Upload changelog.json to Google Cloud Storage
         uses: google-github-actions/upload-cloud-storage@6397bd7208e18d13ba2619ee21b9873edc94427a # v3.0.0
diff --git a/.github/workflows/cut_new_release_candidate.yml b/.github/workflows/cut_new_release_candidate.yml
index d7616e35d51..abb3c756922 100644
--- a/.github/workflows/cut_new_release_candidate.yml
+++ b/.github/workflows/cut_new_release_candidate.yml
@@ -36,6 +36,7 @@ jobs:
     uses: ./.github/workflows/create_release.yml
     permissions:
       contents: write # create_release.yml pushes the release branch/tag and creates and uploads the GitHub release; a reusable-workflow caller must grant everything its callee declares
+      id-token: write # create_release.yml federates its OIDC token to GCP and Octo STS
     needs: compute_channel
     with:
       channel: ${{ needs.compute_channel.outputs.channel }}
diff --git a/.github/workflows/cut_new_releases.yml b/.github/workflows/cut_new_releases.yml
index 6e720e69a9a..8e3c6d23571 100644
--- a/.github/workflows/cut_new_releases.yml
+++ b/.github/workflows/cut_new_releases.yml
@@ -73,6 +73,7 @@ jobs:
     uses: ./.github/workflows/create_release.yml
     permissions:
       contents: write # create_release.yml pushes the release branch/tag and creates and uploads the GitHub release; a reusable-workflow caller must grant everything its callee declares
+      id-token: write # create_release.yml federates its OIDC token to GCP and Octo STS
     needs: get_config
     strategy:
       fail-fast: false