diff --git a/.github/workflows/scorecard-reusable.yml b/.github/workflows/scorecard-reusable.yml
index 0ab298c5a..943517733 100644
--- a/.github/workflows/scorecard-reusable.yml
+++ b/.github/workflows/scorecard-reusable.yml
@@ -6,7 +6,12 @@ name: OSSF Scorecard Reusable Workflow
 on:
   workflow_call:
 
-# Callers must grant contents: read, security-events: write and id-token: write.
+# Callers must grant actions: read, contents: read, security-events: write and
+# id-token: write ON THE CALLING JOB. A job-level `permissions:` block REPLACES
+# the workflow-level one and is never merged with it, so the declarations below
+# cannot elevate a caller that omitted them. `actions: read` is required by
+# Scorecard's Packaging check (Actions.ListWorkflowRunsByFileName); without it
+# the check errors. Audited 2026-09-14: 11 of 13 callers in the estate omitted it.
 # Only default-branch publication receives OIDC; PR analysis cannot publish
 # unmerged results to the public Scorecard dataset or badge.
 permissions:
@@ -19,6 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
+      actions: read
       contents: read
       security-events: write
       id-token: write