diff --git a/.github/workflows/ci-pending.yml b/.github/workflows/ci-pending.yml
index 49312bd..2cf6b07 100644
--- a/.github/workflows/ci-pending.yml
+++ b/.github/workflows/ci-pending.yml
@@ -7,7 +7,6 @@ on:
 permissions:
   contents: read
   issues: read
-  actions: write
 
 jobs:
   mark-pending:
@@ -33,8 +32,8 @@ jobs:
 
       - name: Enable cron poller
         env:
-          # Use GITHUB_TOKEN (with actions:write) for variable access —
-          # the app token may not have the actions_variables permission.
-          GH_TOKEN: ${{ github.token }}
+          # Use the app token — GITHUB_TOKEN cannot write repo variables
+          # (403 "Resource not accessible by integration").
+          GH_TOKEN: ${{ steps.token.outputs.token }}
         run: |
           gh variable set CI_POLLER_HAS_PENDING -R "$GITHUB_REPOSITORY" -b "true"
diff --git a/.github/workflows/ci-poller.yml b/.github/workflows/ci-poller.yml
index 6955130..af3454d 100644
--- a/.github/workflows/ci-poller.yml
+++ b/.github/workflows/ci-poller.yml
@@ -7,7 +7,6 @@ on:
 permissions:
   contents: read
   issues: read
-  actions: write
 
 jobs:
   check-ci:
@@ -140,16 +139,16 @@ jobs:
             fi
           done
 
-      # Disable the poller if no ci-pending issues remain. Uses GITHUB_TOKEN
-      # (with actions:write) since the app token may lack actions_variables
-      # permission.
+      # Disable the poller if no ci-pending issues remain.
       # Note: there's a small race window where ci-pending.yml could set the
       # variable to "true" right before we set it to "false" here. In that case
       # the new issue waits at most one cron tick (5 min) — ci-pending.yml will
       # set the variable again on the next issue:opened event if needed.
       - name: Disable poller if no pending issues remain
         env:
-          GH_TOKEN: ${{ github.token }}
+          # Use the app token — GITHUB_TOKEN cannot write repo variables
+          # (403 "Resource not accessible by integration").
+          GH_TOKEN: ${{ steps.token.outputs.token }}
         run: |
           remaining=$(gh issue list -R "$GITHUB_REPOSITORY" \
             --state open \