diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index b5e8cfd..b5f5b62 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -19,10 +19,14 @@ jobs:
     #   github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
 
     runs-on: ubuntu-latest
+    # write on pull-requests + issues is required for the action to POST its
+    # review back to the PR: inline review comments use the pull-requests API,
+    # the summary comment uses the issues API. With read-only the review runs
+    # but silently posts nothing ("No buffered inline comments").
     permissions:
       contents: read
-      pull-requests: read
-      issues: read
+      pull-requests: write
+      issues: write
       id-token: write
 
     steps:
diff --git a/.github/workflows/vm-e2e-spike.yml b/.github/workflows/vm-e2e-spike.yml
index 5b5df47..6d089b7 100644
--- a/.github/workflows/vm-e2e-spike.yml
+++ b/.github/workflows/vm-e2e-spike.yml
@@ -3,6 +3,8 @@ name: vm-e2e-spike
 on:
   push:
     branches: ["test/vm-e2e-speed"]
+  pull_request:
+    branches: [main, master]
   workflow_dispatch:
 
 jobs:
diff --git a/go.mod b/go.mod
index f6ee6ab..cb94540 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/openbootdotdev/openboot
 
-go 1.25.11
+go 1.25.12
 
 require (
 	github.com/charmbracelet/bubbles v0.20.0