diff --git a/.github/workflows/release-cut.yml b/.github/workflows/release-cut.yml
index 20d62e6e8..7389ddc66 100644
--- a/.github/workflows/release-cut.yml
+++ b/.github/workflows/release-cut.yml
@@ -39,6 +39,13 @@ on:
 
 permissions:
   contents: write
+  # Why: this workflow calls release.yml, whose publish-release job needs
+  # actions: write to dispatch homebrew-bump.yml. Reusable workflows are
+  # capped by the caller's permissions, so the caller must list every
+  # scope the callee needs. Omitting this produced a startup_failure on
+  # run 25244518794 immediately after actions:write was added to
+  # release.yml in f6cc2aee.
+  actions: write
 
 concurrency:
   group: release-cut
diff --git a/.github/workflows/release-rc.yml b/.github/workflows/release-rc.yml
index 3ebdc8c2b..a97aba35b 100644
--- a/.github/workflows/release-rc.yml
+++ b/.github/workflows/release-rc.yml
@@ -17,6 +17,11 @@ on:
 
 permissions:
   contents: write
+  # Why: this workflow calls release.yml, whose publish-release job needs
+  # actions: write to dispatch homebrew-bump.yml. Reusable workflows are
+  # capped by the caller's permissions, so the caller must list every
+  # scope the callee needs. Mirrors the fix in release-cut.yml.
+  actions: write
 
 concurrency:
   group: release-rc