gcloud scheduler add custom claim to token

Question

I have a public service running on cloud run that uses firebase auth (OAuth2) tokens with custom claims (eg admin=true) for authorization. I would like to use the same service to host an endpoint that can be triggered by cloud scheduler.

But in cloud scheduler, I can only select to use an OIDC token. Can I somehow add a custom claim to this OIDC token? Or am I doing someting fundamentally wrong here?

I know I could just host a separate cloud run service that is not open to public and only contains that one endpoint, but this feels a but overkill, since when I do that, I either need to duplicate a lot of code from my existing service to the new service or use it as a "mediator-endpoint" that creates said token for me and then calls the public service, but again, this feels a bit stupid... What are my options here?