diff --git a/.github/workflows/nightly-build.yml b/.github/workflows/nightly-build.yml
index 9fe0ce8bfc..48e4ea4ca1 100644
--- a/.github/workflows/nightly-build.yml
+++ b/.github/workflows/nightly-build.yml
@@ -84,6 +84,11 @@ jobs:
   android:
     name: Nightly Android Build
     needs: [prepare]
+    # build-submit-android.yml contains an attachToRelease job that requests contents: write.
+    # That job is skipped for nightly (it needs a production tag build), but GitHub statically
+    # validates the reusable-workflow permission ceiling, so the caller must grant it here.
+    permissions:
+      contents: write
     uses: ./.github/workflows/build-submit-android.yml
     with:
       profile: testflight-android