diff --git a/.github/workflows/regenerate-poetry-lock.yml b/.github/workflows/regenerate-poetry-lock.yml
index 83f53277ef8..7e4bac017df 100644
--- a/.github/workflows/regenerate-poetry-lock.yml
+++ b/.github/workflows/regenerate-poetry-lock.yml
@@ -11,6 +11,9 @@ on:
       - pyproject.toml
   workflow_dispatch:
 
+permissions:
+  contents: read  # GITHUB_TOKEN is not used for writes; GH_TOKEN (PAT) handles push + PR creation
+
 jobs:
   regenerate-lock:
     runs-on: ubuntu-latest