diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml
index 831db3b..ff30521 100644
--- a/.github/workflows/update.yml
+++ b/.github/workflows/update.yml
@@ -10,6 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      actions: write
       issues: write
     outputs:
       fail_reason: ${{ steps.build_verify.outputs.fail_reason || steps.check.outputs.fail_reason }}
@@ -86,12 +87,16 @@ jobs:
 
       - name: Commit and Push
         if: steps.check.outputs.update_needed == 'true' && steps.build_verify.outcome == 'success'
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git add version.json opencode.nix opencode-desktop.nix flake.lock
           git commit -m "chore: update opencode to ${{ steps.check.outputs.version }}"
           git push
+          # GITHUB_TOKEN pushes do not trigger push workflows; dispatch CI explicitly.
+          gh workflow run ci.yml --repo "$GITHUB_REPOSITORY" --ref "$GITHUB_REF_NAME"
 
       - name: Close resolved failure issues
         if: steps.check.outcome == 'success' && (steps.build_verify.outcome == 'success' || steps.check.outputs.update_needed != 'true')