diff --git a/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.ddoghq.sts.yaml b/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.ddoghq.sts.yaml
new file mode 100644
index 00000000000..d08687c4aa7
--- /dev/null
+++ b/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.ddoghq.sts.yaml
@@ -0,0 +1,14 @@
+# Allows PR detection from ddoghq/datadog-api-spec without granting write access.
+issuer: https://token.actions.githubusercontent.com
+
+subject: repo:ddoghq/datadog-api-spec:pull_request
+
+claim_pattern:
+  base_ref: master
+  event_name: pull_request
+  job_workflow_ref: ddoghq/datadog-api-spec/\.github/workflows/ci-cd\.yml@refs/pull/[0-9]+/merge
+  ref: refs/pull/[0-9]+/merge
+  repository: ddoghq/datadog-api-spec
+
+permissions:
+  pull_requests: read
diff --git a/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml b/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml
new file mode 100644
index 00000000000..8647bd6b7ec
--- /dev/null
+++ b/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml
@@ -0,0 +1,14 @@
+# Allows PR detection from DataDog/datadog-api-spec without granting write access.
+issuer: https://token.actions.githubusercontent.com
+
+subject: repo:DataDog/datadog-api-spec:pull_request
+
+claim_pattern:
+  base_ref: master
+  event_name: pull_request
+  job_workflow_ref: DataDog/datadog-api-spec/\.github/workflows/ci-cd\.yml@refs/pull/[0-9]+/merge
+  ref: refs/pull/[0-9]+/merge
+  repository: DataDog/datadog-api-spec
+
+permissions:
+  pull_requests: read
diff --git a/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.ddoghq.sts.yaml b/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.ddoghq.sts.yaml
new file mode 100644
index 00000000000..4091b742628
--- /dev/null
+++ b/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.ddoghq.sts.yaml
@@ -0,0 +1,15 @@
+# Allows the generation pipeline in ddoghq/datadog-api-spec to push generated code and create PRs.
+issuer: https://token.actions.githubusercontent.com
+
+subject: repo:ddoghq/datadog-api-spec:pull_request
+
+claim_pattern:
+  base_ref: master
+  event_name: pull_request
+  job_workflow_ref: ddoghq/datadog-api-spec/\.github/workflows/ci-cd\.yml@refs/pull/[0-9]+/merge
+  ref: refs/pull/[0-9]+/merge
+  repository: ddoghq/datadog-api-spec
+
+permissions:
+  contents: write
+  pull_requests: write
diff --git a/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml b/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml
new file mode 100644
index 00000000000..e7a9447d250
--- /dev/null
+++ b/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml
@@ -0,0 +1,15 @@
+# Allows the generation pipeline in DataDog/datadog-api-spec to push generated code and create PRs.
+issuer: https://token.actions.githubusercontent.com
+
+subject: repo:DataDog/datadog-api-spec:pull_request
+
+claim_pattern:
+  base_ref: master
+  event_name: pull_request
+  job_workflow_ref: DataDog/datadog-api-spec/\.github/workflows/ci-cd\.yml@refs/pull/[0-9]+/merge
+  ref: refs/pull/[0-9]+/merge
+  repository: DataDog/datadog-api-spec
+
+permissions:
+  contents: write
+  pull_requests: write