diff --git a/.github/workflows/proxy_integration_tests.yml b/.github/workflows/proxy_integration_tests.yml
index 25a7685..bb01325 100644
--- a/.github/workflows/proxy_integration_tests.yml
+++ b/.github/workflows/proxy_integration_tests.yml
@@ -10,6 +10,8 @@ on:
 
 permissions:
   contents: read
+  # Required for setup-node npm cache save under restricted GITHUB_TOKEN scopes.
+  actions: write
 
 jobs:
   integration:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 2a71f70..f536550 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -18,8 +18,11 @@ jobs:
       github.event.workflow_run.conclusion == 'success'
     runs-on: ubuntu-latest
     # Explicit job permissions: org default token scopes must not block OIDC.
+    # actions: write is required for setup-node's npm cache save (contents: read alone
+    # can restore but not reserve/write caches → "token has no writable scopes").
     permissions:
       contents: read
+      actions: write
       id-token: write
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3