diff --git a/.github/workflows/generate-javascript.yml b/.github/workflows/generate-javascript.yml
index c0af3fd53b1..696c58c8ca8 100644
--- a/.github/workflows/generate-javascript.yml
+++ b/.github/workflows/generate-javascript.yml
@@ -67,4 +67,12 @@ jobs:
               env:
                   KUBERNETES_BRANCH: ${{ github.event.inputs.kubernetesBranch }}
                   BASE_BRANCH: ${{ github.ref_name }}
-                  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+                  # GH_TOKEN must be a PAT (not GITHUB_TOKEN) because the repository setting
+                  # "Allow GitHub Actions to create and approve pull requests" is disabled.
+                  # A repository administrator must create a PAT and store it as a repository
+                  # secret named GH_TOKEN before this step can succeed:
+                  #   - Classic PAT: enable the "repo" scope
+                  #   - Fine-grained PAT: enable "Pull requests: write" and "Contents: write"
+                  # WARNING: this step will fail with an authentication error if the secret
+                  # is not configured.
+                  GH_TOKEN: ${{ secrets.GH_TOKEN }}