diff --git a/.github/workflows/homebrew-bump.yml b/.github/workflows/homebrew-bump.yml
index 4a8adf7ce28..513e0ed36b0 100644
--- a/.github/workflows/homebrew-bump.yml
+++ b/.github/workflows/homebrew-bump.yml
@@ -150,6 +150,8 @@ jobs:
             --head "$branch" \
             || gh pr edit "$branch" --title "orca $VERSION"
 
-          # Why: auto-merge so the tap stays hands-free. Tap repo must have
-          # "Allow auto-merge" enabled in settings for this to take effect.
-          gh pr merge "$branch" --squash --auto --delete-branch || true
+          # Why: squash-merge immediately rather than --auto. The tap has no
+          # required checks or branch protection, and `gh pr merge --auto`
+          # only activates when there's something to wait on — on a repo
+          # with no gates it silently no-ops, leaving the PR open forever.
+          gh pr merge "$branch" --squash --delete-branch
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 87fd0ba92fe..8a43145319e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -222,6 +222,11 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      # Why: actions:write is required for `gh workflow run homebrew-bump.yml`
+      # (below). Without it GITHUB_TOKEN gets HTTP 403 "Resource not accessible
+      # by integration" on POST /actions/workflows/:id/dispatches. The default
+      # scoped-down token grants only what the `permissions:` block lists.
+      actions: write
     steps:
       - name: Publish release
         # Why: derive `--prerelease` from the tag shape (not from whatever