diff --git a/.github/workflows/nightly-scan.yml b/.github/workflows/nightly-scan.yml
index 06ddabd..ac86042 100644
--- a/.github/workflows/nightly-scan.yml
+++ b/.github/workflows/nightly-scan.yml
@@ -131,6 +131,23 @@ jobs:
             return 1
           }
 
+          emit_manual_pr_summary() {
+            local message="$1"
+            local action_url="${2:-https://github.com/${GITHUB_REPOSITORY}/pull/new/${BRANCH}}"
+            local action_label="${3:-Open PR manually}"
+
+            echo "::warning::${message}"
+            echo "::warning::${action_label}: ${action_url}"
+            {
+              echo "## Nightly scan results pushed"
+              echo ""
+              echo "${message}"
+              echo ""
+              echo "- Branch: \`${BRANCH}\`"
+              echo "- ${action_label}: ${action_url}"
+            } >> "$GITHUB_STEP_SUMMARY"
+          }
+
           # Validate expected scan artifacts exist
           MISSING=()
           for f in "${NIGHTLY_ALLOWED_FILES[@]}"; do
@@ -201,15 +218,42 @@ jobs:
           # Create PR if one doesn't already exist (scoped to this repo, not forks)
           EXISTING_PR=$(gh pr list --head "${{ github.repository_owner }}:$BRANCH" --base "$DEFAULT_BRANCH" --state open --json number --jq '.[0].number // empty')
           if [ -z "$EXISTING_PR" ]; then
-            gh pr create \
+            set +e
+            PR_OUTPUT=$(gh pr create \
               --base "$DEFAULT_BRANCH" \
               --head "$BRANCH" \
               --title "$PR_TITLE" \
-              --body-file /tmp/nightly-pr-body.md
+              --body-file /tmp/nightly-pr-body.md 2>&1)
+            PR_STATUS=$?
+            set -e
+
+            if [ $PR_STATUS -eq 0 ]; then
+              printf '%s\n' "$PR_OUTPUT"
+            elif printf '%s' "$PR_OUTPUT" | grep -F -q 'GitHub Actions is not permitted to create or approve pull requests'; then
+              emit_manual_pr_summary "GitHub Actions could not create a pull request with GITHUB_TOKEN."
+            else
+              printf '%s\n' "$PR_OUTPUT" >&2
+              exit $PR_STATUS
+            fi
           else
-            gh pr edit "$EXISTING_PR" \
+            set +e
+            PR_OUTPUT=$(gh pr edit "$EXISTING_PR" \
               --title "$PR_TITLE" \
-              --body-file /tmp/nightly-pr-body.md
+              --body-file /tmp/nightly-pr-body.md 2>&1)
+            PR_STATUS=$?
+            set -e
+
+            if [ $PR_STATUS -eq 0 ]; then
+              printf '%s\n' "$PR_OUTPUT"
+            elif printf '%s' "$PR_OUTPUT" | grep -F -q 'GitHub Actions is not permitted to create or approve pull requests'; then
+              emit_manual_pr_summary \
+                "GitHub Actions could not update PR #${EXISTING_PR} with GITHUB_TOKEN." \
+                "https://github.com/${GITHUB_REPOSITORY}/pull/${EXISTING_PR}" \
+                "Review existing PR manually"
+            else
+              printf '%s\n' "$PR_OUTPUT" >&2
+              exit $PR_STATUS
+            fi
           fi
 
       - name: 📤 Upload database artifact