diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index fff4433..e78e89e 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -8,8 +8,13 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+# The called reusable's gitleaks job requests pull-requests:write +
+# actions:read (PR summary comments); a called workflow cannot escalate
+# past the caller's grant, so they must be granted here.
 permissions:
   contents: read
+  pull-requests: write
+  actions: read
 jobs:
   scan:
     uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@a44c93a5cd3d293ee3e8b488444dcdc19c4e5d49