diff --git a/.github/chainguard/gitlab.github-access.read.sts.yaml b/.github/chainguard/gitlab.github-access.read.sts.yaml
new file mode 100644
index 00000000000..c47028c1920
--- /dev/null
+++ b/.github/chainguard/gitlab.github-access.read.sts.yaml
@@ -0,0 +1,7 @@
+issuer: https://gitlab.ddbuild.io
+
+subject_pattern: "project_path:DataDog/system-tests:ref_type:branch:ref:.*"
+
+permissions:
+  contents: read
+  pull_requests: read