diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 396db4e..1f5bfdf 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -47,7 +47,7 @@ jobs:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
         run: |
           if [[ -z "$RELEASE_TOKEN" ]]; then
-            echo "::error::RELEASE_TOKEN is not set. A real release run pushes the bump branch and merges its own PR, which needs a fine-grained PAT with contents and pull-requests write. Add it as a repository secret, or re-run with dry_run to build only."
+            echo "::error::RELEASE_TOKEN is not set. A real release run pushes the bump branch and merges its own PR, which needs a credential that can bypass the ruleset — a fine-grained PAT, or a GitHub App token. Add it as a repository secret, or re-run with dry_run to build only."
             exit 1
           fi
           echo "RELEASE_TOKEN is present."
@@ -195,7 +195,12 @@ jobs:
           echo "Keystore opens and contains the alias."
 
       - name: Build the release bundle
-        run: ./gradlew :app:bundleRelease --no-daemon --stacktrace
+        run: |
+          set -euo pipefail
+          # gradlew is mode 100644 in the index — git on Windows does not track the executable
+          # bit, so a Linux runner checks it out non-executable. Set it here rather than assuming.
+          chmod +x gradlew
+          ./gradlew :app:bundleRelease --no-daemon --stacktrace
 
       - name: Verify the signature
         id: sign
diff --git a/.github/workflows/tag.yml b/.github/workflows/tag.yml
index cfe3a23..5cbce4c 100644
--- a/.github/workflows/tag.yml
+++ b/.github/workflows/tag.yml
@@ -34,8 +34,10 @@ on:
         type: boolean
         default: false
 
+# Creating a tag and a GitHub release is a write. Tags are not covered by the branch ruleset, so
+# the job's own GITHUB_TOKEN is enough here — no PAT or App token needed for run 2.
 permissions:
-  contents: read
+  contents: write
 
 concurrency:
   group: openloop-release
@@ -46,7 +48,7 @@ jobs:
     name: Cut tag and GitHub release
     runs-on: ubuntu-latest
     env:
-      GH_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+      GH_TOKEN: ${{ secrets.RELEASE_TOKEN || github.token }}
 
     steps:
       - name: Checkout
@@ -54,7 +56,7 @@ jobs:
         with:
           ref: main
           fetch-depth: 0
-          token: ${{ secrets.RELEASE_TOKEN }}
+          token: ${{ secrets.RELEASE_TOKEN || github.token }}
 
       # tag-release.ps1 warns when releases/openloop-<version>-<code>.aab is missing. In CI it
       # always would be, which turns a real safety check into noise — so pull the artifact the