diff --git a/.github/workflows/mergify-labels-copier.yml b/.github/workflows/mergify-labels-copier.yml
index d5ff3ed0e4..cdd8a546ab 100644
--- a/.github/workflows/mergify-labels-copier.yml
+++ b/.github/workflows/mergify-labels-copier.yml
@@ -13,11 +13,12 @@ jobs:
     runs-on: ubuntu-latest
     if: startsWith(github.head_ref, 'mergify/bp/')
     permissions:
-      # Add GH labels
-      pull-requests: write
-      # See https://github.com/cli/cli/issues/6274
-      repository-projects: read
+      # OIDC for create-token (required when use-ephemeral-token is true)
+      id-token: write
     steps:
-      - uses: elastic/oblt-actions/mergify/labels-copier@v1
+      - name: Copy parent labels to backport
+        uses: elastic/oblt-actions/mergify/labels-copier@v1
         with:
           excluded-labels-regex: "^backport-*"
+          use-ephemeral-token: true
+