diff --git a/.github/workflows/auto-author-assign.yml b/.github/workflows/auto-author-assign.yml
index 9dda4fa..57675fd 100644
--- a/.github/workflows/auto-author-assign.yml
+++ b/.github/workflows/auto-author-assign.yml
@@ -13,4 +13,14 @@ jobs:
     steps:
       - uses: toshimaru/auto-author-assign@v3.1.0
         with:
-          repo-token: ${{ secrets.GH_PAT }}
+          # `GH_PAT` is not configured on this repo, so this input resolved to an empty string
+          # and the action failed with 'Input required and not supplied: repo-token' on every
+          # pull request. `github.token` is always populated, and the job already holds the
+          # `pull-requests: write` permission the action needs.
+          #
+          # This has to be fixed *on master*. Two earlier attempts (908f19a, a88de87) changed
+          # this file on a feature branch and had no effect: `pull_request_target` did not use
+          # the base branch's copy of the workflow — PRs whose base already carried a working
+          # token still failed with the empty-input error — so the definition that runs is the
+          # one on the default branch. Changing it anywhere else is invisible.
+          repo-token: ${{ secrets.GH_PAT || github.token }}
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 32cae12..7a7faf2 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -15,7 +15,13 @@ jobs:
     steps:
       - uses: googleapis/release-please-action@v5
         with:
-          # this assumes that you have created a personal access token
-          # (PAT) and configured it as a GitHub action secret named
-          # `MY_RELEASE_PLEASE_TOKEN` (this secret name is not important).
-          token: ${{ secrets.GH_PAT }}
+          # `GH_PAT` is not configured on this repo, so this resolved to an empty string and
+          # every push to master failed with 'release-please failed: Input required and not
+          # supplied: token'. `github.token` is always populated and the job is granted the
+          # `contents: write` and `pull-requests: write` it needs.
+          #
+          # Known limitation of the built-in token, and the reason a PAT is the usual advice:
+          # events created with `GITHUB_TOKEN` do not trigger workflows, so the release PR
+          # release-please opens will not run the `pull_request` checks. The release itself is
+          # unaffected. Set `GH_PAT` on the repo or org and it takes precedence automatically.
+          token: ${{ secrets.GH_PAT || github.token }}