diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 4f3c8e1..e903fb8 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -54,8 +54,10 @@ jobs:
     timeout-minutes: 15
     permissions:
       contents: read
-      pull-requests: read
-      issues: read
+      # write, not read: Claude replies by posting comments, so the run's own
+      # GITHUB_TOKEN needs to be able to write them.
+      pull-requests: write
+      issues: write
       actions: read # Required for Claude to read CI results on PRs
     steps:
       - name: Checkout repository
@@ -69,6 +71,11 @@ jobs:
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 
+          # Use the run's own token, matching claude-code-review.yml. Without
+          # this the action falls back to minting one over OIDC, which needs
+          # `id-token: write` and the Claude GitHub App installed on the org.
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
           # This is an optional setting that allows Claude to read CI results on PRs
           additional_permissions: |
             actions: read