diff --git a/.github/workflows/pr-ci-sweeper.yml b/.github/workflows/pr-ci-sweeper.yml
index 85a27e6e610d..6d2610e317f2 100644
--- a/.github/workflows/pr-ci-sweeper.yml
+++ b/.github/workflows/pr-ci-sweeper.yml
@@ -34,26 +34,23 @@ jobs:
         with:
           ref: ${{ github.sha }}
           persist-credentials: false
+      # No permission-* subset here: requesting a permission the installation
+      # does not grant fails token minting outright, and these installations
+      # lack actions:write/checks:read (every sweep failed 2026-07-24 until the
+      # subset was reverted). No inputs = the app's full granted set, which the
+      # sweep's re-fire lane is known to work with.
       - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
         id: app-token
         continue-on-error: true
         with:
           app-id: "2729701"
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-          permission-actions: write
-          permission-checks: read
-          permission-issues: write
-          permission-pull-requests: write
       - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
         id: app-token-fallback
         if: steps.app-token.outcome == 'failure'
         with:
           app-id: "2971289"
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY_FALLBACK }}
-          permission-actions: write
-          permission-checks: read
-          permission-issues: write
-          permission-pull-requests: write
       - name: Sweep dropped PR CI runs
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with: