diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 1cab07d..1f62d7c 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -98,6 +98,9 @@ jobs:
       volumes:
         - /srv/act-runner-cache/uv:/uv-cache
     steps:
+      # CI_TOKEN needs write:repository scope (not just read) — this job
+      # pushes commits and tags to master, unlike ruff-check/ruff-format/
+      # type-check/test above, which only need to check out the repo.
       - uses: actions/checkout@v4
         with:
           token: ${{ secrets.CI_TOKEN }}