diff --git a/.github/workflows/staging-ci.yml b/.github/workflows/staging-ci.yml
index 9b97c9b8..254e806e 100644
--- a/.github/workflows/staging-ci.yml
+++ b/.github/workflows/staging-ci.yml
@@ -18,6 +18,7 @@ permissions:
   contents: write
   issues: write                    # Claude review creates issues for critical findings
   pull-requests: write             # Auto-promote creates + merges PR to main
+  id-token: write                  # Required by claude-code-action for OIDC auth
 
 concurrency:
   group: staging-ci