diff --git a/.github/workflows/sipa-ci.yml b/.github/workflows/sipa-ci.yml
index ea6788f1..2acb098d 100644
--- a/.github/workflows/sipa-ci.yml
+++ b/.github/workflows/sipa-ci.yml
@@ -34,6 +34,8 @@ jobs:
         run: docker push registry.agdsn.de/agdsn/coreos/sipa/sipa:${GITHUB_REF##*/}
   test:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
       - name: Check out sipa and submodules
         uses: actions/checkout@v3
@@ -64,10 +66,12 @@ jobs:
         if: always() # always run even if the previous step fails
         with:
           report_paths: 'junit/test-*.xml'
+          annotate_only: true
       - name: Upload results to Codecov
         uses: codecov/codecov-action@v5
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           disable_search: true
           files: ./cov/cov-results.xml
+          use_oidc: true
           verbose: true