diff --git a/.github/workflows/release-please-reusable.yml b/.github/workflows/release-please-reusable.yml
index 5f4f965..5e92929 100644
--- a/.github/workflows/release-please-reusable.yml
+++ b/.github/workflows/release-please-reusable.yml
@@ -1,6 +1,21 @@
 name: Release Please (reusable)
 on:
   workflow_call:
+    secrets:
+      release-please-token:
+        description: >
+          Optional PAT / GitHub App installation token used to create the
+          release-please pull request and GitHub Release. Required when the
+          calling repository has "Allow GitHub Actions to create and approve
+          pull requests" disabled (Settings > Actions > General > Workflow
+          permissions) — the default GITHUB_TOKEN cannot open pull requests
+          in that case and release-please-action fails with:
+            "GitHub Actions is not permitted to create or approve pull
+            requests."
+          Falls back to the default GITHUB_TOKEN when unset, preserving
+          existing behavior for repos that already allow Actions to create
+          PRs.
+        required: false
 jobs:
   release-please:
     runs-on: ubuntu-latest
@@ -12,5 +27,6 @@ jobs:
     steps:
       - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         with:
+          token: ${{ secrets.release-please-token || github.token }}
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 2fd89b9..3a52652 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -10,3 +10,5 @@ jobs:
       pull-requests: write
       issues: write
     uses: ./.github/workflows/release-please-reusable.yml
+    secrets:
+      release-please-token: ${{ secrets.RELEASE_PLEASE_TOKEN }}