diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
index d440934..1a789af 100644
--- a/.github/workflows/dependabot-auto-merge.yml
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -28,10 +28,16 @@ name: Dependabot auto-merge
 # back to GITHUB_TOKEN, so existing callers keep working unchanged — but any
 # caller that deploys on push wants the App.
 #
-# The App needs three repository permissions: Contents (read/write),
-# Pull requests (read/write), and Workflows (read/write). Workflows is easy to
-# miss and not optional: Dependabot's `github-actions` PRs edit files under
-# .github/workflows/, and a token without it is refused when merging them.
+# The App needs two repository permissions: Contents (read/write) and
+# Pull requests (read/write). Metadata (read) comes along mandatorily.
+#
+# It does NOT need Workflows (write), despite Dependabot's `github-actions` PRs
+# editing files under .github/workflows/. That permission governs *pushing*
+# workflow files through the Contents API, not *merging* a PR that changes them.
+# Verified against this org on 2026-08-21: app/github-actions — itself an App
+# token, with no workflows permission — has merged github-actions bumps in
+# ci-workflows (#17, #18), bankimporter (#47, #51) and ecm (#33). An earlier
+# revision of this comment claimed the opposite and was wrong.
 # ---------------------------------------------------------------------------
 
 on:
diff --git a/README.md b/README.md
index 2d6a492..5637d3d 100644
--- a/README.md
+++ b/README.md
@@ -185,10 +185,10 @@ immediately.
   nothing ships. Omit them and the workflow falls back to `GITHUB_TOKEN` and warns in the
   run log.
 
-  The App needs three repository permissions: **Contents** (read/write), **Pull requests**
-  (read/write) and **Workflows** (read/write). Workflows is easy to miss and not optional:
-  Dependabot's `github-actions` PRs edit files under `.github/workflows/`, and a token
-  without it is refused when merging them.
+  The App needs two repository permissions: **Contents** (read/write) and **Pull requests**
+  (read/write); Metadata (read) is mandatory and comes along. It does **not** need
+  Workflows (write) — that permission governs *pushing* workflow files through the Contents
+  API, not *merging* a PR that changes them.
 
 ### Sample usage