diff --git a/.github/workflows/issue-done-on-main-merge.yml b/.github/workflows/issue-done-on-main-merge.yml
index c75d86a9..9bd24481 100644
--- a/.github/workflows/issue-done-on-main-merge.yml
+++ b/.github/workflows/issue-done-on-main-merge.yml
@@ -36,8 +36,12 @@ jobs:
       (github.event_name == 'workflow_dispatch' && inputs.pr != '')
     runs-on: ubuntu-latest
     env:
-      # The github-api.mjs client reads GITHUB_TOKEN; the built-in token has
-      # `issues: write` scoped to this repo (the issue tracker is on GitHub).
+      # The github-api.mjs client reads GITHUB_TOKEN (not GH_TOKEN); the built-in
+      # token has `issues: write` scoped to this repo (the issue tracker is on
+      # GitHub). Explicit `github.token` — the built-in GITHUB_TOKEN env is not
+      # guaranteed on every event path; passing it via the documented context is
+      # the robust form (same as agent-pr-ready-automerge.yml).
+      GITHUB_TOKEN: ${{ github.token }}
       GH_TOKEN: ${{ github.token }}
     steps:
       - uses: actions/checkout@v5
diff --git a/.github/workflows/plan-issue-ready-on-main-merge.yml b/.github/workflows/plan-issue-ready-on-main-merge.yml
index c6b1ec6b..3f9d5d2f 100644
--- a/.github/workflows/plan-issue-ready-on-main-merge.yml
+++ b/.github/workflows/plan-issue-ready-on-main-merge.yml
@@ -43,8 +43,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     env:
-      # The github-api.mjs client reads GITHUB_TOKEN; the built-in token has
-      # `issues: write` scoped to this repo (the tracker is on GitHub).
+      # The github-api.mjs client reads GITHUB_TOKEN (not GH_TOKEN); the built-in
+      # token has `issues: write` scoped to this repo (the tracker is on GitHub).
+      # Explicit `github.token` — the built-in GITHUB_TOKEN env is not guaranteed
+      # on every event path; passing it via the documented context is the robust form
+      # (same as agent-pr-ready-automerge.yml).
+      GITHUB_TOKEN: ${{ github.token }}
       GH_TOKEN: ${{ github.token }}
     steps:
       - uses: actions/checkout@v5