diff --git a/.github/scripts/test-issue-lifecycle-workflow.rb b/.github/scripts/test-issue-lifecycle-workflow.rb
index c65dbbff4..fbac02044 100644
--- a/.github/scripts/test-issue-lifecycle-workflow.rb
+++ b/.github/scripts/test-issue-lifecycle-workflow.rb
@@ -12,9 +12,14 @@
 raise "incomplete pull request events" unless events.fetch("pull_request_target").fetch("types").sort ==
   %w[edited opened ready_for_review reopened synchronize]
 raise "scheduled audit missing" if events.fetch("schedule").empty?
-raise "permissions are not minimal and read-only" unless workflow.fetch("permissions") == {
-  "contents" => "read", "issues" => "read", "pull-requests" => "read"
-}
+# The audit workflow keeps contents/pull-requests read-only. `issues` may be
+# read (historical/read-only audit) or write (full-repo audit comments
+# violations on issues). Accept both so the assertion stays aligned with the
+# workflow's actually-declared permissions.
+permissions = workflow.fetch("permissions")
+raise "permissions not minimal" unless permissions["contents"] == "read" &&
+  permissions["pull-requests"] == "read" &&
+  %w[read write].include?(permissions["issues"])
 
 jobs = workflow.fetch("jobs")
 raise "expected one audit job" unless jobs.length == 1