diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 01149333e50..42c49c4df07 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -12,16 +12,13 @@ concurrency: ${{ github.workflow }}-${{ github.ref }}
 
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   deploy:
     if: github.repository == 'anomalyco/opencode' && (github.ref_name == 'dev' || github.ref_name == 'production' || github.ref_name == 'beta')
     runs-on: blacksmith-4vcpu-ubuntu-2404
-    # production keeps its own environment so dev and beta pushes can never reach production credentials.
-    environment: ${{ github.ref_name == 'production' && 'production' || 'release' }}
-    permissions:
-      contents: read
-      id-token: write
+    environment: ${{ github.ref_name }}
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0