diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 7e01a8fa62601..53b7b220375e5 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -62,9 +62,6 @@ env:
   RCLONE_S3_ENDPOINT: "${{ secrets.CF_ENDPOINT }}"
   RCLONE_S3_PROVIDER: Cloudflare
   RCLONE_S3_SECRET_ACCESS_KEY: "${{ secrets.AWS_SECRET_ACCESS_KEY }}"
-permissions:
-  id-token: write
-  contents: read
 jobs:
   build-windows-x64-stage-1:
     name: Windows Stage 1
@@ -228,6 +225,9 @@ jobs:
       SCCACHE_BUCKET: "waterfox-cache-win-x64-stage-3"
       SCCACHE_ENDPOINT: "${{ secrets.CF_ENDPOINT }}"
       SCCACHE_REGION: auto
+    permissions:
+      id-token: write
+      contents: read
     steps:
       - name: Install sccache
         if: ${{ inputs.TRIGGER_EVENT == 'workflow_dispatch' }}