diff --git a/.github/workflows/auto-ready.yml b/.github/workflows/auto-ready.yml
index 4e878c48..05a69b00 100644
--- a/.github/workflows/auto-ready.yml
+++ b/.github/workflows/auto-ready.yml
@@ -13,10 +13,11 @@
 #   - ci.yml's `ci-green` audit step hand-verifies its own gate; a downstream
 #     promote job there would need an EXEMPT entry and would tangle promotion
 #     into the required check's job graph.
-#   - the promotion needs `pull-requests: write`; ci.yml is least-privilege
-#     `contents: read` at the top and PR jobs there run on untrusted-input
-#     paths. This workflow checks out nothing and runs no project code, so the
-#     write scope never coexists with anything a PR author controls.
+#   - the promotion needs `pull-requests: write` and `contents: write` (see
+#     the permissions block); ci.yml is least-privilege `contents: read` at
+#     the top and PR jobs there run on untrusted-input paths. This workflow
+#     checks out nothing and runs no project code, so the write scopes never
+#     coexist with anything a PR author controls.
 #   - run-level `conclusion == 'success'` is exactly "the whole CI run passed"
 #     (it subsumes `ci-green`; it is marginally stricter — a red report-only
 #     `coverage` job also holds the draft, which is a safe default).
@@ -57,9 +58,14 @@ concurrency:
   cancel-in-progress: true
 
 # `pull-requests: write` marks the PR ready (a GraphQL mutation, via `gh pr
-# ready`); `actions: write` dispatches the review workflow. Nothing is checked
-# out, so no contents scope at all.
+# ready`) — but the `markPullRequestReadyForReview` mutation also demands
+# `contents: write` from integration tokens (cli/cli#6924); without it the
+# call fails with "Resource not accessible by integration" even though nothing
+# here reads or writes repo contents. `actions: write` dispatches the review
+# workflow. Nothing is checked out and no project code runs, so neither write
+# scope ever coexists with anything a PR author controls.
 permissions:
+  contents: write
   pull-requests: write
   actions: write