diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate-vault.yml
similarity index 84%
rename from .github/workflows/renovate.yml
rename to .github/workflows/renovate-vault.yml
index abade6bf..52f6a5d2 100644
--- a/.github/workflows/renovate.yml
+++ b/.github/workflows/renovate-vault.yml
@@ -16,9 +16,13 @@ on:
   schedule:
     - cron: '30 4,6 * * *'
 
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
   call-workflow:
-    uses: rancher/renovate-config/.github/workflows/renovate.yml@release
+    uses: rancher/renovate-config/.github/workflows/renovate-vault.yml@release
     with:
       logLevel: ${{ inputs.logLevel || 'info' }}
       overrideSchedule: ${{ github.event.inputs.overrideSchedule == 'true' && '{''schedule'':null}' || '' }}