diff --git a/README.md b/README.md
index fc8c51f..1c79878 100644
--- a/README.md
+++ b/README.md
@@ -23,7 +23,9 @@ The aim of **uppt** is to make a very simple, secure release workflow for mainta
 2. Create a [GitHub environment](https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/manage-environments) named `npm`. You can scope it to `v*` tags, and configure any restrictions on it (such as requiring approvals if you want).
    ![a screenshot of github environment configuration settings](https://raw.githubusercontent.com/danielroe/uppt/main/assets/trusted-publisher.png)
 
-**3.** Add the following workflow to your repo in `.github/workflows/release.yml`, and you're done!
+**3.** Allow GitHub Actions to create pull requests on your repo: under **Settings → Actions → General → Workflow permissions** (`https://github.com/<user>/<repo>/settings/actions`), check **Allow GitHub Actions to create and approve pull requests**. Without this, `uppt/pr` fails with `403 Forbidden: GitHub Actions is not permitted to create or approve pull requests` when opening the release PR.
+
+**4.** Add the following workflow to your repo in `.github/workflows/release.yml`, and you're done!
 
 ```yaml
 name: release
@@ -129,6 +131,10 @@ This subaction runs `pnpm pack` (if you have a `pnpm-lock.yaml`) and then runs `
 
 ## Prerequisites
 
+For `pr` to work you need:
+
+- **Allow GitHub Actions to create and approve pull requests** enabled under **Settings → Actions → General → Workflow permissions** (`https://github.com/<user>/<repo>/settings/actions`).
+
 For `publish` to work end to end you need:
 
 - An npmjs.com trusted-publisher entry per package, pointing at the caller's `release.yml` and the `npm` environment, with the `npm stage publish` permission chip.