diff --git a/docs/admin-state/php-bin-after.json b/docs/admin-state/php-bin-after.json
index ffbd811..d9ad27a 100644
--- a/docs/admin-state/php-bin-after.json
+++ b/docs/admin-state/php-bin-after.json
@@ -14,7 +14,7 @@
     "url": "https://api.github.com/repos/Bigpixelrocket/php-bin/subscription"
   },
   "branchProtection": null,
-  "capturedAt": "2026-08-04T12:48:50Z",
+  "capturedAt": "2026-08-05T08:15:54Z",
   "environments": {
     "environments": [
       {
@@ -208,14 +208,14 @@
     ],
     "verified_allowed": false
   },
-  "snapshotDigest": "sha256:7cc0280415bc135c1d262e01a429c18c6116dc770d8c8bfcf94d83187ccfc53a",
+  "snapshotDigest": "sha256:3486213a008395f750d5d8c4bc33380704ac687fcf41dfd7adf84d104a2ca770",
   "variables": [
     "AUTORELEASE_EMAIL_FROM",
     "AUTORELEASE_EMAIL_TO",
     "AUTORELEASE_OWNER"
   ],
   "workflowPermissions": {
-    "can_approve_pull_request_reviews": false,
+    "can_approve_pull_request_reviews": true,
     "default_workflow_permissions": "read"
   }
 }
diff --git a/scripts/configure-github-autorelease b/scripts/configure-github-autorelease
index d31db0e..d78d283 100755
--- a/scripts/configure-github-autorelease
+++ b/scripts/configure-github-autorelease
@@ -120,7 +120,12 @@ try:
         "PUT",
         input_value={
             "default_workflow_permissions": "read",
-            "can_approve_pull_request_reviews": False,
+            # Despite its name, this flag governs the single "create and
+            # approve pull requests" permission. The watcher and consumer
+            # open deterministic PRs with GITHUB_TOKEN daily, so it must stay
+            # enabled; approvals remain owner-only through the ruleset and
+            # protected controls.
+            "can_approve_pull_request_reviews": True,
         },
     )
     gh("api", f"repos/{args.repo}/immutable-releases", "--method", "PUT")