diff --git a/.github/workflows/upload.yml b/.github/workflows/upload.yml
index 83c7643..4905601 100644
--- a/.github/workflows/upload.yml
+++ b/.github/workflows/upload.yml
@@ -4,6 +4,10 @@ on: [push]
 
 env:
   ECR_REPOSITORY: toolbox
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
   upload-docker-image:
     runs-on: ubuntu-latest
@@ -14,8 +18,7 @@ jobs:
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v4
         with:
-          aws-access-key-id: ${{ secrets.TRUSS_AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.TRUSS_AWS_SECRET_ACCESS_KEY }}
+          role-to-assume: arn:aws:iam::127178877223:role/github/github-truss
           aws-region: us-east-2
 
       - name: Login to AWS ECR