diff --git a/.github/workflows/auto-approve.yml b/.github/workflows/auto-approve.yml
index 10aebb4..064a08e 100644
--- a/.github/workflows/auto-approve.yml
+++ b/.github/workflows/auto-approve.yml
@@ -6,6 +6,10 @@ on:
   pull_request_target:
     types: [opened, reopened, ready_for_review, synchronize]
 
+# This caller job needs no token of its own — the reusable workflow mints its
+# own App token and uses the org PAT. Pin to none for least privilege.
+permissions: {}
+
 concurrency:
   group: auto-approve-${{ github.event.pull_request.number }}
   cancel-in-progress: true