diff --git a/.github/workflows/scorecard-reusable.yml b/.github/workflows/scorecard-reusable.yml
index d71898d3..90aa0918 100644
--- a/.github/workflows/scorecard-reusable.yml
+++ b/.github/workflows/scorecard-reusable.yml
@@ -5,8 +5,13 @@ name: OSSF Scorecard Reusable Workflow
 on:
   workflow_call:
 
+# NOTE: no top-level `actions: read` here. It was added by the estate-wide
+# security-compliance sweep (0ced540e) but no job in this file uses it, and a
+# reusable's top-level permissions must be granted by EVERY caller — callers
+# granting the estate-default `contents: read` (+ their own job needs) hit a
+# 0-second startup_failure before any job runs. Same lesson as the note in
+# rust-ci-reusable.yml. The scorecard job declares its own block below.
 permissions:
-  actions: read
   contents: read
 
 jobs: