diff --git a/.github/workflows/composer-update.yml b/.github/workflows/composer-update.yml
index 5a2033f..f1ad373 100644
--- a/.github/workflows/composer-update.yml
+++ b/.github/workflows/composer-update.yml
@@ -5,6 +5,10 @@ on:
     - cron: '50 21 * * 3'
   workflow_dispatch:
 
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
   update:
     runs-on: ubuntu-latest
@@ -13,8 +17,9 @@ jobs:
       id: update-action
       uses: UN-OCHA/actions/composer-update@main
       with:
-        aws_access_key_id: ${{ secrets.ECR_AWS_ACCESS_KEY_ID }}
-        aws_secret_access_key: ${{ secrets.ECR_AWS_SECRET_ACCESS_KEY }}
+        aws_role: ${{ vars.AWS_ROLE }}
+        aws_region: ${{ vars.AWS_REGION }}
+        aws_account: ${{ vars.AWS_ACCOUNT }}
         composer_scripts: "true"
         github_access_token: ${{ secrets.PAT }}
         patch_branch: ${{ github.head_ref || github.ref_name }}
diff --git a/.github/workflows/docker-build-image.yml b/.github/workflows/docker-build-image.yml
index eb916bc..1908b54 100644
--- a/.github/workflows/docker-build-image.yml
+++ b/.github/workflows/docker-build-image.yml
@@ -12,6 +12,10 @@ on:
 #  release:
 #    types: [published]
 
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -21,14 +25,12 @@ jobs:
       id: build-action
       uses: UN-OCHA/actions/drupal-docker-build@main
       with:
-        aws_access_key_id: ${{ secrets.ECR_AWS_ACCESS_KEY_ID }}
-        aws_secret_access_key: ${{ secrets.ECR_AWS_ACCESS_KEY_ID }}
+        aws_role: ${{ vars.AWS_ROLE }}
+        aws_region: ${{ vars.AWS_REGION }}
+        aws_account: ${{ vars.AWS_ACCOUNT }}
         docker_registry_url: public.ecr.aws
         docker_registry_path: /unocha/
         docker_image: web-site
-        docker_username: ${{ secrets.ECR_AWS_ACCESS_KEY_ID }}
-        docker_password: ${{ secrets.ECR_AWS_SECRET_ACCESS_KEY }}
-        ecr_github_token: ${{ secrets.ECR_GITHUB_TOKEN }}
         ecr_jenkins_token: ${{ secrets.JENKINS_ECR_TOKEN }}
         slack_bot_token: ${{ secrets.SLACK_BOT_TOKEN }}
         slack_channel_name: ${{ vars.SLACK_CHANNEL }}