diff --git a/.github/workflows/very_good_cli.yaml b/.github/workflows/very_good_cli.yaml
index 5aebe7c43..c536fe3fb 100644
--- a/.github/workflows/very_good_cli.yaml
+++ b/.github/workflows/very_good_cli.yaml
@@ -25,8 +25,12 @@ on:
 jobs:
   build:
     strategy:
+      fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest]
+    permissions:
+      contents: read
+      pull-requests: write
     uses: VeryGoodOpenSource/very_good_workflows/.github/workflows/flutter_package.yml@v2
     with:
       runs_on: ${{ matrix.os }}
@@ -34,10 +38,12 @@ jobs:
       coverage_excludes: "**/*.{gen,g}.dart"
       concurrency: 1
       run_skipped: true
-      run_bloc_lint: false
       # The CLI's own test suite is run directly rather than through the test optimizer,
       # matching the CI behavior prior to adopting this shared workflow.
       test_optimization: false
+      # Run once per workflow so the matrix jobs do not race on the sticky PR comment.
+      run_cognitive_complexity: ${{ matrix.os == 'ubuntu-latest' }}
+      cognitive_complexity_fail_on_increase: true
 
   pana:
     uses: VeryGoodOpenSource/very_good_workflows/.github/workflows/pana.yml@v2