diff --git a/.github/workflows/pr-check-managed-files-hosted.yml b/.github/workflows/pr-check-managed-files-hosted.yml
index f37cfb7..8675d98 100644
--- a/.github/workflows/pr-check-managed-files-hosted.yml
+++ b/.github/workflows/pr-check-managed-files-hosted.yml
@@ -73,6 +73,7 @@ on:
 
 permissions:
   contents: read
+  pull-requests: read
 
 # Canonical block from the standards `concurrency-policy` component: a newer
 # push to the same pull request cancels the in-flight guard run; the