diff --git a/.github/actions/github.issue.welcome/README.md b/.github/actions/github.issue.welcome/README.md
index cb74356..c46d8bd 100644
--- a/.github/actions/github.issue.welcome/README.md
+++ b/.github/actions/github.issue.welcome/README.md
@@ -13,8 +13,17 @@ Messages are passed as data and retain their Markdown formatting.
 
 The reusable workflow supplies default messages, falls back to `github.token` when
 no token secret is provided, and serializes runs for the same issue or PR. Callers
-grant the permissions needed for their events; a PR-only caller needs only
-`pull-requests: write`.
+grant the permissions needed for their events. A PR-only caller needs both
+`issues: read` for the Issues API used to query contribution history and
+`pull-requests: write` for comments. An issue-only caller needs `issues: write`.
+
+```yaml
+permissions:
+  issues: read
+  pull-requests: write
+```
+
+For a caller handling both issues and pull requests:
 
 ```yaml
 name: Welcome
diff --git a/.github/actions/github.issue.welcome/action.yaml b/.github/actions/github.issue.welcome/action.yaml
index fe890b7..cede041 100644
--- a/.github/actions/github.issue.welcome/action.yaml
+++ b/.github/actions/github.issue.welcome/action.yaml
@@ -12,7 +12,7 @@ inputs:
   github_token:
     required: false
     default: ${{ github.token }}
-    description: "(Optional) The GitHub token used to read contribution history and post comments. Requires `issues: write` for issues or `pull-requests: write` for pull requests. Defaults to the workflow's default token."
+    description: "(Optional) The GitHub token used to read contribution history and post comments. Requires `issues: write` for issues; for pull requests, requires both `issues: read` for history and `pull-requests: write` for comments. Defaults to the workflow's default token."
 
 outputs:
   comment_id:
diff --git a/.github/workflows/github.issue.welcome.yaml b/.github/workflows/github.issue.welcome.yaml
index 8e36298..5baaf22 100644
--- a/.github/workflows/github.issue.welcome.yaml
+++ b/.github/workflows/github.issue.welcome.yaml
@@ -38,7 +38,7 @@ on:
     secrets:
       token:
         required: false
-        description: "(Optional) The GitHub API token to use when communicating with GitHub API. Defaults to the workflow's default token. Requires `issues: write` for issues or `pull-requests: write` for pull requests."
+        description: "(Optional) The GitHub API token to use when communicating with GitHub API. Defaults to the workflow's default token. Requires `issues: write` for issues; for pull requests, requires both `issues: read` for history and `pull-requests: write` for comments."
 
 
 jobs:
diff --git a/.github/workflows/github.pr.yaml b/.github/workflows/github.pr.yaml
index 09d79bb..3343b9b 100644
--- a/.github/workflows/github.pr.yaml
+++ b/.github/workflows/github.pr.yaml
@@ -48,6 +48,7 @@ jobs:
     if: ${{ github.event_name == 'pull_request_target' && github.event.action == 'opened' }}
 
     permissions:
+      issues: read
       pull-requests: write
 
     with: