diff --git a/.github/workflows/pr-issue-linkage.yml b/.github/workflows/pr-issue-linkage.yml
index 9b4e427..773e891 100644
--- a/.github/workflows/pr-issue-linkage.yml
+++ b/.github/workflows/pr-issue-linkage.yml
@@ -1,13 +1,14 @@
 name: pr-issue-linkage
 
 # Requires the PR body to carry a native closing keyword (or a no-issue marker)
-# and a non-empty "## Related" section; the reusable below is authoritative on
-# the exact accepted forms. Thin caller of the
-# shared pr-issue-linkage reusable; the emitted required-check context is
-# `pr-issue-linkage / pr-issue-linkage`. pull_request_target runs the
-# base-branch definition (the gate reads PR body metadata only — no head code
-# runs); `edited` re-validates on a body edit. Public repo: runs on the
-# reusable's hosted default runner.
+# plus non-empty "## Summary", "## Fix", "## Verification", and "## Related"
+# sections; the reusable below is authoritative on the exact accepted forms.
+# Thin caller of the shared pr-issue-linkage reusable; the emitted
+# required-check context is `pr-issue-linkage / pr-issue-linkage`.
+# pull_request_target runs the base-branch definition (the gate reads PR body
+# metadata only — no head code runs); `edited` re-validates on a body edit.
+# Public repo: no runner selector here, so the reusable's `runner` input is left
+# at its `ubuntu-24.04` default.
 on:
   pull_request_target:
     types: [opened, edited, reopened, synchronize]
@@ -21,5 +22,15 @@ concurrency:
 
 jobs:
   pr-issue-linkage:
-    permissions: {}
-    uses: melodic-software/ci-workflows/.github/workflows/pr-issue-linkage.yml@e94438746c300b02385a7f8a2a2dcd19a7f4ad4a # v0.10.2
+    # The reusable's own permissions block requests both scopes where v0.10.2
+    # requested neither: pull-requests: read to read the PR body it validates,
+    # and actions: read for its cancelled-versus-timed_out prerequisite
+    # resolver. A reusable cannot elevate caller permissions, and GitHub rejects
+    # it at startup when the caller grants a stricter set — the required context
+    # then never materializes at all, rather than reporting red. Standards'
+    # runner-policy records the same pair as this ref's
+    # `minimumCallerPermissions`, so it is a floor, not surplus.
+    permissions:
+      pull-requests: read
+      actions: read
+    uses: melodic-software/ci-workflows/.github/workflows/pr-issue-linkage.yml@7107b34832a7b6db5d08d3b132621c599fbe5e50 # v0.14.2