diff --git a/.github/workflows/gradle-build-test.yaml b/.github/workflows/gradle-build-test.yaml
index 412559b..e63f98d 100644
--- a/.github/workflows/gradle-build-test.yaml
+++ b/.github/workflows/gradle-build-test.yaml
@@ -632,7 +632,6 @@ jobs:
     timeout-minutes: ${{ inputs.grype_timeout_minutes }}
     permissions:
       contents: read
-      issues: read  # Read maintainer-approved CVE bypass issues
     steps:
       # One harden-runner step with the policy computed, rather than
       # two selected by condition: harden-runner declares a 'pre'
diff --git a/.github/workflows/maven-build-test.yaml b/.github/workflows/maven-build-test.yaml
index 7d675fb..dee05d0 100644
--- a/.github/workflows/maven-build-test.yaml
+++ b/.github/workflows/maven-build-test.yaml
@@ -698,7 +698,6 @@ jobs:
     timeout-minutes: ${{ inputs.grype_timeout_minutes }}
     permissions:
       contents: read
-      issues: read  # Read maintainer-approved CVE bypass issues
     steps:
       # One harden-runner step with the policy computed, rather than
       # two selected by condition: harden-runner declares a 'pre'
diff --git a/.github/workflows/testing.yaml b/.github/workflows/testing.yaml
index a680bc0..ef90fad 100644
--- a/.github/workflows/testing.yaml
+++ b/.github/workflows/testing.yaml
@@ -47,7 +47,6 @@ jobs:
     permissions:
       contents: read
       pull-requests: read  # repository-metadata-action queries PR data
-      issues: read  # Grype scan reads approved CVE bypass issues
     uses: ./.github/workflows/maven-build-test.yaml
     with:
       repository: 'apache/maven'
@@ -63,7 +62,6 @@ jobs:
     permissions:
       contents: read
       pull-requests: read  # repository-metadata-action queries PR data
-      issues: read  # Grype scan reads approved CVE bypass issues
     uses: ./.github/workflows/gradle-build-test.yaml
     with:
       repository: 'onap/portal-ng-preferences'
diff --git a/examples/gradle/build-test/gerrit.yaml b/examples/gradle/build-test/gerrit.yaml
index 3adc13e..c718f86 100644
--- a/examples/gradle/build-test/gerrit.yaml
+++ b/examples/gradle/build-test/gerrit.yaml
@@ -126,7 +126,6 @@ jobs:
     permissions:
       contents: read
       pull-requests: read  # repository-metadata-action queries PR data
-      issues: read  # Grype scan reads approved CVE bypass issues
     # REPLACE the pinned SHA below with a java-workflows release SHA
     # (or your instantiated workflows repository's release SHA).
     # The all-zero SHA is a non-functional placeholder, NOT a real commit.
diff --git a/examples/gradle/build-test/github.yaml b/examples/gradle/build-test/github.yaml
index d341461..205d0ec 100644
--- a/examples/gradle/build-test/github.yaml
+++ b/examples/gradle/build-test/github.yaml
@@ -36,7 +36,6 @@ jobs:
     permissions:
       contents: read
       pull-requests: read  # repository-metadata-action queries PR data
-      issues: read  # Grype scan reads approved CVE bypass issues
     # REPLACE the pinned SHA below with a java-workflows release SHA
     # (or your instantiated workflows repository's release SHA).
     # The all-zero SHA is a non-functional placeholder, NOT a real commit.
diff --git a/examples/maven/build-test/gerrit.yaml b/examples/maven/build-test/gerrit.yaml
index 5d8f745..3dd1d03 100644
--- a/examples/maven/build-test/gerrit.yaml
+++ b/examples/maven/build-test/gerrit.yaml
@@ -126,7 +126,6 @@ jobs:
     permissions:
       contents: read
       pull-requests: read  # repository-metadata-action queries PR data
-      issues: read  # Grype scan reads approved CVE bypass issues
     # REPLACE the pinned SHA below with a java-workflows release SHA
     # (or your instantiated workflows repository's release SHA).
     # The all-zero SHA is a non-functional placeholder, NOT a real commit.
diff --git a/examples/maven/build-test/github.yaml b/examples/maven/build-test/github.yaml
index 9de0a65..91659fe 100644
--- a/examples/maven/build-test/github.yaml
+++ b/examples/maven/build-test/github.yaml
@@ -36,7 +36,6 @@ jobs:
     permissions:
       contents: read
       pull-requests: read  # repository-metadata-action queries PR data
-      issues: read  # Grype scan reads approved CVE bypass issues
     # REPLACE the pinned SHA below with a java-workflows release SHA
     # (or your instantiated workflows repository's release SHA).
     # The all-zero SHA is a non-functional placeholder, NOT a real commit.