diff --git a/.github/workflows/todos.yaml b/.github/workflows/todos.yaml
index 518647f..1911b8d 100644
--- a/.github/workflows/todos.yaml
+++ b/.github/workflows/todos.yaml
@@ -9,8 +9,8 @@ permissions: {}
 jobs:
   todos:
     permissions:
-      contents: read # checkout to scan for TODO comments
-      issues: write # open/maintain TODO tracking issues
+      contents: read # checkout so the scanner can read the source files
+      issues: write # open/maintain the tracking issues the scanner manages
     uses: devantler-tech/reusable-workflows/.github/workflows/scan-for-todo-comments.yaml@d6c7133cb8cb13189b97993aeb3f4d120f27479d # v5.4.1
     secrets:
       APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}