diff --git a/.github/workflows/release-fast-path.yml b/.github/workflows/release-fast-path.yml
index dea88a4e..86abaf7f 100644
--- a/.github/workflows/release-fast-path.yml
+++ b/.github/workflows/release-fast-path.yml
@@ -16,6 +16,7 @@ on:
 permissions:
   contents: read
   packages: write
+  actions: write   # issue #1702: required so the fallback `gh workflow run deploy.yml` dispatch is allowed
 
 concurrency:
   group: release-fast-path-${{ github.ref }}
diff --git a/cmd/server/release_fast_path_workflow_test.go b/cmd/server/release_fast_path_workflow_test.go
index 42cc34f7..09ff6ad7 100644
--- a/cmd/server/release_fast_path_workflow_test.go
+++ b/cmd/server/release_fast_path_workflow_test.go
@@ -38,8 +38,10 @@ func TestReleaseFastPathWorkflowExists(t *testing.T) {
 		t.Errorf("release-fast-path.yml: missing required push.tags trigger 'v[0-9]+.[0-9]+.[0-9]+'")
 	}
 
-	// Permissions: needs packages:write to re-tag in GHCR, contents:read for checkout.
-	for _, perm := range []string{"packages: write", "contents: read"} {
+	// Permissions: needs packages:write to re-tag in GHCR, contents:read for
+	// checkout, and actions:write so the fallback `gh workflow run deploy.yml`
+	// dispatch is allowed (issue #1702 — fallback returned 403 without it).
+	for _, perm := range []string{"packages: write", "contents: read", "actions: write"} {
 		if !strings.Contains(src, perm) {
 			t.Errorf("release-fast-path.yml: missing required permission %q", perm)
 		}