diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 075b641..d75d090 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,6 +24,10 @@ jobs:
   java:
     name: ${{ matrix.name }}
     runs-on: ubuntu-latest
+    # The test report is published as a check run, which the read-only default token cannot create.
+    permissions:
+      contents: read
+      checks: write
     strategy:
       # One service failing should not hide the state of the other two.
       fail-fast: false
diff --git a/frontend/src/App.tsx b/frontend/src/App.tsx
index de3d32e..8b5a8a4 100644
--- a/frontend/src/App.tsx
+++ b/frontend/src/App.tsx
@@ -14,7 +14,13 @@ import { RegisterPage } from './pages/RegisterPage'
 export function App() {
   return (
     <AuthProvider>
-      <BrowserRouter>
+      {/*
+        The site is served from a subdirectory on GitHub Pages, so the router has to be told where
+        it starts. Without this every path arrives as /<repo>/books, matches no route, falls to the
+        catch-all and navigates to /books at the domain root - which really is a 404. BASE_URL is
+        '/' during development, so this is a no-op there.
+      */}
+      <BrowserRouter basename={import.meta.env.BASE_URL}>
         <Routes>
           <Route path="/login" element={<LoginPage />} />
           <Route path="/register" element={<RegisterPage />} />