diff --git a/.github/workflows/alerts.yaml b/.github/workflows/alerts.yaml
index d6406549..1f8b1b96 100644
--- a/.github/workflows/alerts.yaml
+++ b/.github/workflows/alerts.yaml
@@ -10,12 +10,13 @@ jobs:
   apply-alerts:
     name: Apply alerts to cluster
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
       - name: deploy to prod
-        uses: nais/deploy/actions/deploy@v1
+        uses: nais/deploy/actions/deploy@v2
         env:
-          APIKEY: ${{ secrets.NAIS_DEPLOY_APIKEY }}
           CLUSTER: prod-gcp
           RESOURCE: .nais/alerts.yaml
diff --git a/.github/workflows/kafka.yaml b/.github/workflows/kafka.yaml
index d2b1bf06..70d9eb4b 100644
--- a/.github/workflows/kafka.yaml
+++ b/.github/workflows/kafka.yaml
@@ -8,6 +8,9 @@ on:
       - '.github/workflows/kafka.yaml'
       - '.nais/kafka/**'
 
+permissions:
+  id-token: write
+
 jobs:
   deploy-kafka-dev:
     name: Deploy Kafka topic to NAIS dev-gcp
@@ -16,17 +19,15 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Deploy behandler-dialogmelding-bestilling dev
-        uses: nais/deploy/actions/deploy@v1
+        uses: nais/deploy/actions/deploy@v2
         env:
-          APIKEY: ${{ secrets.NAIS_DEPLOY_APIKEY }}
           CLUSTER: dev-gcp
           RESOURCE: .nais/kafka/behandler-dialogmelding-bestilling.yaml
           VARS: .nais/kafka/dev.json
 
       - name: Deploy behandler-dialogmelding-status dev
-        uses: nais/deploy/actions/deploy@v1
+        uses: nais/deploy/actions/deploy@v2
         env:
-          APIKEY: ${{ secrets.NAIS_DEPLOY_APIKEY }}
           CLUSTER: dev-gcp
           RESOURCE: .nais/kafka/behandler-dialogmelding-status.yaml
           VARS: .nais/kafka/dev.json
@@ -39,17 +40,15 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Deploy behandler-dialogmelding-bestilling prod
-        uses: nais/deploy/actions/deploy@v1
+        uses: nais/deploy/actions/deploy@v2
         env:
-          APIKEY: ${{ secrets.NAIS_DEPLOY_APIKEY }}
           CLUSTER: prod-gcp
           RESOURCE: .nais/kafka/behandler-dialogmelding-bestilling.yaml
           VARS: .nais/kafka/prod.json
 
       - name: Deploy behandler-dialogmelding-status prod
-        uses: nais/deploy/actions/deploy@v1
+        uses: nais/deploy/actions/deploy@v2
         env:
-          APIKEY: ${{ secrets.NAIS_DEPLOY_APIKEY }}
           CLUSTER: prod-gcp
           RESOURCE: .nais/kafka/behandler-dialogmelding-status.yaml
           VARS: .nais/kafka/prod.json