diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0000f0a..1861811 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -102,7 +102,9 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          token: ${{ secrets.GITHUB_TOKEN }}
+          # WORKFLOW_PAT must be a classic PAT with repo+workflow scopes.
+          # Without it, pushes that touch .github/workflows/ will be rejected.
+          token: ${{ secrets.WORKFLOW_PAT || github.token }}
 
       - name: Configure git bot identity
         run: |
@@ -111,7 +113,7 @@ jobs:
 
       - name: Merge develop → main
         run: |
-          git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git
+          git remote set-url origin https://x-access-token:${{ secrets.WORKFLOW_PAT || github.token }}@github.com/${{ github.repository }}.git
           LAST=$(git log --oneline -1 origin/develop)
           git checkout main
           git pull --ff-only origin main