diff --git a/.github/workflows/daily_ai_fix.yaml b/.github/workflows/daily_ai_fix.yaml
index d16497c642..057cfa06d3 100644
--- a/.github/workflows/daily_ai_fix.yaml
+++ b/.github/workflows/daily_ai_fix.yaml
@@ -33,6 +33,7 @@ permissions:
   contents: write
   issues: write
   pull-requests: write
+  id-token: write  # claude-code-action fetches a GitHub OIDC token to auth the OAuth flow
 
 concurrency:
   group: ai-fix-sweep
diff --git a/.github/workflows/on_issues_ai_triage.yaml b/.github/workflows/on_issues_ai_triage.yaml
index 74bb18a5e3..0fe03bdf15 100644
--- a/.github/workflows/on_issues_ai_triage.yaml
+++ b/.github/workflows/on_issues_ai_triage.yaml
@@ -17,6 +17,7 @@ on:
 permissions:
   contents: read
   issues: write
+  id-token: write  # claude-code-action fetches a GitHub OIDC token to auth the OAuth flow
 
 concurrency:
   group: ai-triage-${{ github.event.issue.number }}