diff --git a/.github/chainguard/baseline-scanner.sts.yaml b/.github/chainguard/baseline-scanner.sts.yaml
new file mode 100644
index 0000000..78e8ffe
--- /dev/null
+++ b/.github/chainguard/baseline-scanner.sts.yaml
@@ -0,0 +1,16 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/octo-sts/app/refs/heads/main/pkg/octosts/octosts.TrustPolicy.json
+#
+# Octo STS trust policy for the OSPS Baseline Scanner workflow.
+# Allows GitHub Actions runs on the main branch of this repository to
+# federate for a short-lived GitHub App token, replacing the long-lived
+# GH_AUTH_TOKEN PAT. See .github/workflows/baseline.yaml.
+
+issuer: https://token.actions.githubusercontent.com
+subject: repo:ossf/security-insights:ref:refs/heads/main
+
+permissions:
+  metadata: read # Repository and organization metadata, branch rules
+  contents: read # Repo contents, languages, releases, security policy
+  administration: read # Branch protection rule via GraphQL
+  checks: read # Check suites/runs on the latest commit
+  statuses: read # Classic commit status API
diff --git a/.github/workflows/baseline.yaml b/.github/workflows/baseline.yaml
index 60f88f0..353ee5c 100644
--- a/.github/workflows/baseline.yaml
+++ b/.github/workflows/baseline.yaml
@@ -15,6 +15,7 @@ jobs:
 
     permissions:
       contents: read # Clone the repository
+      id-token: write # Federate with Octo STS for a short-lived GitHub App token
       security-events: write # Required for SARIF upload
 
     steps:
@@ -27,12 +28,23 @@ jobs:
         with:
           persist-credentials: false
 
+      # Exchanges this workflow's OIDC identity for a short-lived GitHub App
+      # token, per the trust policy in .github/chainguard/baseline-scanner.sts.yaml.
+      # Replaces the workflow GITHUB_TOKEN, which lacks the administration,
+      # checks, and statuses read access some baseline checks need.
+      - name: Federate with Octo STS
+        id: octo-sts
+        uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1
+        with:
+          scope: ${{ github.repository }}
+          identity: baseline-scanner
+
       - name: Run Baseline Action
         uses: revanite-io/osps-baseline-action@b7d860b68755627c30ab692473511c90daee3ae8 # v1.3.4
         with:
           owner: ${{ github.repository_owner }}
           repo: ${{ github.event.repository.name }}
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ steps.octo-sts.outputs.token }}
           catalog: "osps-baseline"
           upload-sarif: "true"