diff --git a/.github/workflows/features.yml b/.github/workflows/features.yml
index 7ef37a9a..caedd9bf 100644
--- a/.github/workflows/features.yml
+++ b/.github/workflows/features.yml
@@ -11,7 +11,9 @@ permissions: {}
 jobs:
   build:
     permissions:
-      contents: read
+      contents: read       # checkout
+      deployments: write   # ably/sdk-upload-action
+      id-token: write      # aws-actions/configure-aws-credentials (OIDC)
     uses: ably/features/.github/workflows/sdk-features.yml@main
     with:
       repository-name: ably-python