diff --git a/.github/workflows/gate.yml b/.github/workflows/gate.yml
index c0188ae..949215b 100644
--- a/.github/workflows/gate.yml
+++ b/.github/workflows/gate.yml
@@ -6,6 +6,11 @@ on:
   pull_request:
     branches: [master]
 
+permissions:
+  checks: write
+  pull-requests: write
+  contents: read
+
 jobs:
   gate:
     runs-on: ubuntu-latest
@@ -34,6 +39,8 @@ jobs:
 
       - name: Run Gate on itself
         run: php gate certify --coverage=100
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Upload coverage artifact
         if: github.event_name == 'push' && github.ref == 'refs/heads/master'
diff --git a/app/Broken.php b/app/Broken.php
new file mode 100644
index 0000000..ed05aa9
--- /dev/null
+++ b/app/Broken.php
@@ -0,0 +1 @@
+<?php function broken(): int { return "string"; }