diff --git a/.github/workflows/dump-token-claims.yaml b/.github/workflows/dump-token-claims.yaml
new file mode 100644
index 0000000..beaedad
--- /dev/null
+++ b/.github/workflows/dump-token-claims.yaml
@@ -0,0 +1,30 @@
+name: Dump OIDC token claims
+
+on:
+  workflow_dispatch:
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  dump-token:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Fetch and decode OIDC token claims
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          AUDIENCE="debug-token-dump"
+          ENCODED_AUDIENCE="$(jq -rn --arg audience "$AUDIENCE" '$audience | @uri')"
+
+          TOKEN_RESPONSE="$(curl -sSf \
+            -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+            "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=${ENCODED_AUDIENCE}")"
+
+          TOKEN="$(jq -r '.value' <<< "$TOKEN_RESPONSE")"
+
+          echo "OIDC claims:"
+          jq -R 'split(".") | .[1] | @base64d | fromjson' <<< "$TOKEN"