diff --git a/src/config/repoAccess.ts b/src/config/repoAccess.ts
index d259224..ea980eb 100644
--- a/src/config/repoAccess.ts
+++ b/src/config/repoAccess.ts
@@ -379,6 +379,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
       { team: 'lead-maintainers', permission: 'maintain' },
       { team: 'core-maintainers', permission: 'admin' },
       { team: 'steering-committee', permission: 'maintain' },
+      { team: 'maintainers', permission: 'pull' },
     ],
     users: [{ username: 'sambhav', permission: 'admin' }],
   },
diff --git a/src/config/roles.ts b/src/config/roles.ts
index 86e53a3..96afb91 100644
--- a/src/config/roles.ts
+++ b/src/config/roles.ts
@@ -109,6 +109,8 @@ export const ROLES: readonly Role[] = [
   {
     id: ROLE_IDS.MAINTAINERS,
     description: 'General maintainers',
+    // No parent team: must not inherit steering-committee repo permissions
+    github: { team: 'maintainers' },
     discord: { role: 'maintainers (synced)' },
     // GWS user accounts are opt-in: maintainers add firstName/lastName/googleEmailPrefix
     // to their entry in users.ts via PR to get an @modelcontextprotocol.io account