diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index dacff28..19e5d60 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,6 +19,15 @@ name: release
 #     Repository             nextup
 #     Workflow filename      release.yml
 #     Environment            (blank)
+#     Allowed actions        npm publish (ticked)
+#
+# "Allowed actions" is the trap. A configuration created after 2026-09-03
+# defaults to `npm stage publish` only, and this workflow runs `npm publish`.
+# The symptom is a run that signs the provenance and then dies with
+# `403 OIDC permission denied for this action`: the token exchange succeeded,
+# the action was refused. Configurations created before 2026-05-20 got
+# `npm publish` automatically, which is why an older package's copy of this
+# file publishes while a new package's does not (nextup v0.1.2/v0.1.3, 2026-09-08).
 #
 # Renaming this file, or moving the job to another workflow, breaks publishing
 # until that field is updated to match.