diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml
index f15a5c5..c0c1361 100644
--- a/.github/workflows/conformance.yml
+++ b/.github/workflows/conformance.yml
@@ -4,12 +4,10 @@ on:
   push:
     branches:
       - main
-  pull_request_target:
+  pull_request:
 
 jobs:
   selftest:
-    permissions:
-      id-token: write
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
diff --git a/test/conftest.py b/test/conftest.py
index 1ae0605..40dc485 100644
--- a/test/conftest.py
+++ b/test/conftest.py
@@ -16,7 +16,7 @@
 
 def pytest_addoption(parser):
     """
-    Add the `--entrypoint` flag to the `pytest` CLI.
+    Add the `--entrypoint` and `--identity-token` flags to the `pytest` CLI.
     """
     parser.addoption(
         "--entrypoint",
@@ -25,6 +25,13 @@ def pytest_addoption(parser):
         required=True,
         type=str,
     )
+    parser.addoption(
+        "--identity-token",
+        action="store",
+        help="the OIDC token to supply to the Sigstore client under test",
+        required=True,
+        type=str,
+    )
 
 
 @pytest.fixture