diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index c95ad1b4f..a9329adff 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -1,6 +1,11 @@
 name: Claude Code
 
-permissions: {}
+# GITHUB_TOKEN needs contents:read and actions:read — required by
+# claude-code-action for restoring trusted config files from the base branch.
+# All other GitHub API access uses the App token.
+permissions:
+  contents: read
+  actions: read
 
 on:
   issue_comment: