diff --git a/lib/crates/fabro-cli/src/commands/install.rs b/lib/crates/fabro-cli/src/commands/install.rs
index d5c2145e4..b8fabff08 100644
--- a/lib/crates/fabro-cli/src/commands/install.rs
+++ b/lib/crates/fabro-cli/src/commands/install.rs
@@ -948,7 +948,8 @@ fn build_github_app_manifest(app_name: &str, port: u16, web_url: &str) -> serde_
             "pull_requests": "write",
             "checks": "write",
             "issues": "write",
-            "emails": "read"
+            "emails": "read",
+            "vulnerability_alerts": "write"
         },
         "default_events": []
     })
@@ -2662,6 +2663,10 @@ client_id = "client-id"
             manifest["setup_url"],
             serde_json::json!("https://app.example.com/setup"),
         );
+        assert_eq!(
+            manifest["default_permissions"]["vulnerability_alerts"],
+            serde_json::json!("write"),
+        );
     }
 
     #[tokio::test]
diff --git a/lib/crates/fabro-server/src/install.rs b/lib/crates/fabro-server/src/install.rs
index aae91785a..6416c340e 100644
--- a/lib/crates/fabro-server/src/install.rs
+++ b/lib/crates/fabro-server/src/install.rs
@@ -2053,7 +2053,8 @@ fn build_github_app_manifest(
             "pull_requests": "write",
             "checks": "write",
             "issues": "write",
-            "emails": "read"
+            "emails": "read",
+            "vulnerability_alerts": "write"
         },
         "default_events": []
     })