diff --git a/.github/workflows/codex-nudge.yml b/.github/workflows/codex-nudge.yml
index ef19dc6..3866a03 100644
--- a/.github/workflows/codex-nudge.yml
+++ b/.github/workflows/codex-nudge.yml
@@ -10,7 +10,9 @@ on:
 
 permissions:
   contents: read
-  pull-requests: read
+  # createComment on a pull request needs pull-requests:write; issues:write
+  # alone returns 403 Resource not accessible by integration.
+  pull-requests: write
   issues: write
 
 concurrency: