diff --git a/.github/chainguard/self.gitlab.read.sts.yaml b/.github/chainguard/self.gitlab.read.sts.yaml
index 236d4bf690..8b71f3340b 100644
--- a/.github/chainguard/self.gitlab.read.sts.yaml
+++ b/.github/chainguard/self.gitlab.read.sts.yaml
@@ -5,6 +5,5 @@ subject_pattern: "project_path:DataDog/.*"
 claim_pattern:
   project_path: "DataDog/helm-charts"
   ref: ".+"
-  ref_protected: "true"
 permissions:
   contents: read
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 97d084921f..45bd59e3a7 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -73,7 +73,7 @@ e2e:
     - export E2E_GCP_PRIVATE_KEY_PASSWORD
 
     # Set GITHUB_TOKEN to avoid getting rate-limited when pulumi sdk downloads the kubernetes provider
-    - export GITHUB_TOKEN=$(aws ssm get-parameter --region us-east-1 --name ci.helm-charts.github_token --with-decryption --query "Parameter.Value" --out text)
+    - export GITHUB_TOKEN=$(dd-octo-sts token --scope DataDog/datadog-agent --policy self.gitlab.read))
 
     # Use S3 backend to store stack status
     - export PULUMI_CONFIG_PASSPHRASE=$(aws ssm get-parameter --region us-east-1 --name ci.helm-charts.pulumi_password --with-decryption --query "Parameter.Value" --out text)
@@ -96,3 +96,6 @@ e2e:
 
   script:
     - E2E_BUILD_TAGS=$E2E_BUILD_TAGS E2E_PROFILE=ci E2E_AGENT_VERSION=$E2E_AGENT_VERSION make test-e2e
+  id_tokens:
+    DDOCTOSTS_ID_TOKEN:
+      aud: dd-octo-sts