diff --git a/.github/chainguard/staging-package-version-check.sts.yaml b/.github/chainguard/staging-package-version-check.sts.yaml
new file mode 100644
index 0000000..1e96698
--- /dev/null
+++ b/.github/chainguard/staging-package-version-check.sts.yaml
@@ -0,0 +1,12 @@
+issuer: https://accounts.google.com
+
+# package-version-check@staging-enforce-cd1e.iam.gserviceaccount.com
+subject: "114701398486030379354"
+
+permissions:
+  contents: read
+  checks: write
+  pull_requests: read
+
+repositories:
+- os