diff --git a/.github/workflows/hotfix.yml b/.github/workflows/hotfix.yml
index 11f0b1c821..273938c575 100644
--- a/.github/workflows/hotfix.yml
+++ b/.github/workflows/hotfix.yml
@@ -40,6 +40,8 @@ jobs:
           APPLE_API_KEY_BASE64: ${{ secrets.APPLE_API_KEY_BASE64 }}
           APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
           APPLE_API_KEY_ISSUER: ${{ secrets.APPLE_API_KEY_ISSUER }}
+          # Elevated permissions token is needed here or otherwise GitHub
+          # blocks pushing the hotfix branch without `workflows` permission.
           GH_TOKEN: ${{ secrets.GHA_ELEVATED_PERMISSIONS_TOKEN }}
         run: |
           git config --global user.name "Dax the Duck"