diff --git a/.github/workflows/maint-68-sync-consumer-repos.yml b/.github/workflows/maint-68-sync-consumer-repos.yml
index ccb17ed02..752c4d1a8 100644
--- a/.github/workflows/maint-68-sync-consumer-repos.yml
+++ b/.github/workflows/maint-68-sync-consumer-repos.yml
@@ -480,6 +480,7 @@ jobs:
           owner: ${{ steps.repo_meta.outputs.repo_owner }}
           repositories: ${{ steps.repo_meta.outputs.repo_name }}
           permission-contents: write
+          permission-pull-requests: read
           permission-workflows: write
 
       - name: Checkout Workflows
@@ -979,7 +980,11 @@ jobs:
         env:
           SYNC_BRANCH: ${{ needs.prepare.outputs.sync_branch }}
         with:
-          github-token: ${{ env.REPO_TOKEN }}
+          # The owner PAT is used for consumer writes below and can be depleted by
+          # unrelated fleet activity.  This read is safe for the freshly minted,
+          # consumer-scoped Workflows App token, which keeps a rate-limited owner
+          # PAT from preventing an existing stable delivery PR from being found.
+          github-token: ${{ steps.workflows_app_token.outputs.token }}
           script: |
             const { isConsumerOpenPr } = require('./workflows/.github/scripts/sync_tracker_state');
             const branchName = process.env.SYNC_BRANCH;
diff --git a/tests/workflows/test_sync_manifest_delivery.py b/tests/workflows/test_sync_manifest_delivery.py
index e29247ce3..f662f4971 100644
--- a/tests/workflows/test_sync_manifest_delivery.py
+++ b/tests/workflows/test_sync_manifest_delivery.py
@@ -344,6 +344,7 @@ def test_sync_fanout_is_canary_gated_and_promotion_is_plan_bound() -> None:
     assert 'sync_branch="sync/workflows-candidate"' in source
     assert 'sync_branch="sync/workflows-delivery"' in source
     assert "const branchName = process.env.SYNC_BRANCH;" in source
+    assert "github-token: ${{ steps.workflows_app_token.outputs.token }}" in source
     assert 'branch_name="$SYNC_BRANCH"' in source
     assert "stable_plan_rotation" in source
     assert "expectedStableBranch" in source
@@ -589,6 +590,7 @@ def test_maint68_reuses_stable_delivery_pr_without_resetting_an_unchanged_head()
     )
     assert "actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3" in source
     assert "permission-contents: write" in source
+    assert "permission-pull-requests: read" in source
     assert "permission-workflows: write" in source
     assert "gh api" not in source
     assert 'git config user.name "github-actions[bot]"' not in source