diff --git a/.github/scripts/claude-code-review-workflow-contract_test.py b/.github/scripts/claude-code-review-workflow-contract_test.py
index 5186d9b21c..63a7907d23 100644
--- a/.github/scripts/claude-code-review-workflow-contract_test.py
+++ b/.github/scripts/claude-code-review-workflow-contract_test.py
@@ -155,6 +155,7 @@ class ClaudeCodeReviewWorkflowContractTest(unittest.TestCase):
             label_job,
         )
         self.assertIn("issues: write", label_job)
+        self.assertIn("pull-requests: write", label_job)
         self.assertIn("github.rest.issues.addLabels", label_job)
         self.assertIn(
             "const labels = ['safe-to-review', 'safe-to-test'];",
diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index c545be98e4..3c7e2d35da 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -86,6 +86,10 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       issues: write
+      # issues.addLabels on a *pull request* requires the PR-scoped
+      # permission; issues: write alone 403s with "Resource not accessible
+      # by integration" (see kdlbs/kandev#2532 and siblings).
+      pull-requests: write
 
     steps:
       - name: Add automatic fork approval labels