diff --git a/.github/workflows/on.push.yml b/.github/workflows/on.push.yml
index ef3606bd2..720de395b 100644
--- a/.github/workflows/on.push.yml
+++ b/.github/workflows/on.push.yml
@@ -77,6 +77,7 @@ jobs:
     name: "Checks"
     uses: ./.github/workflows/checks.scorecards.yml
     permissions:
+      attestations: "read"
       actions: "read"
       contents: "read"
       checks: "read"