diff --git a/.github/workflows/pythonpackage.yml b/.github/workflows/pythonpackage.yml
index b108354..f32a527 100644
--- a/.github/workflows/pythonpackage.yml
+++ b/.github/workflows/pythonpackage.yml
@@ -22,6 +22,11 @@ concurrency:
 
 jobs:
   test:
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      FLAKINESS_PROJECT: vinitkumar/json2xml
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -67,7 +72,7 @@ jobs:
     - name: Install dependencies
       run: |
         uv pip install --system -e .
-        uv pip install --system pytest pytest-xdist pytest-cov xmltodict
+        uv pip install --system pytest pytest-xdist pytest-cov xmltodict pytest-flakiness
 
     - name: Create coverage directory
       run: mkdir -p coverage/reports
diff --git a/lat.md/architecture.md b/lat.md/architecture.md
index 5f96130..e9520ba 100644
--- a/lat.md/architecture.md
+++ b/lat.md/architecture.md
@@ -76,7 +76,7 @@ Dependabot checks the root and documentation Python dependency manifests weekly,
 
 GitHub Actions workflows run with read-only tokens by default and use full SHA pins so third-party action updates are explicit.
 
-The `.github/workflows/` files declare the minimum `permissions:` scopes needed by each workflow, with CodeQL retaining `security-events: write` for result upload and TestPyPI retaining `id-token: write` for explicit trusted-publishing runs. Release-branch pushes build distributions and run Twine checks; TestPyPI upload is a manual opt-in because that external registry requires separate publisher configuration. Action references are pinned to immutable commits with the upstream tag retained in comments for reviewability, and `.github/dependabot.yml` checks the `github-actions` ecosystem weekly so those pins do not silently age. The Python test matrix pins its PyPy 3.11 job to an explicit PyPy release so CI keeps exercising the intended CPython 3.11.15-compatible runtime instead of silently drifting with runner cache updates. It also exercises regular CPython 3.15.0b3 while leaving that beta's free-threaded builds out of CI until the runner support is less brittle.
+The `.github/workflows/` files declare the minimum `permissions:` scopes needed by each workflow, with CodeQL retaining `security-events: write` for result upload and TestPyPI retaining `id-token: write` for explicit trusted-publishing runs. The Python test job also scopes `id-token: write` and `FLAKINESS_PROJECT` to its pytest matrix so the flakiness reporter can authenticate through GitHub OIDC without exposing that permission to lint. Release-branch pushes build distributions and runs Twine checks; TestPyPI upload is a manual opt-in because that external registry requires separate publisher configuration. Action references are pinned to immutable commits with the upstream tag retained in comments for reviewability, and `.github/dependabot.yml` checks the `github-actions` ecosystem weekly so those pins do not silently age. The Python test matrix pins its PyPy 3.11 job to an explicit PyPy release so CI keeps exercising the intended CPython 3.11.15-compatible runtime instead of silently drifting with runner cache updates. It also exercises regular CPython 3.15.0b3 while leaving that beta's free-threaded builds out of CI until the runner support is less brittle.
 
 Rust extension CI triggers on Rust sources, Rust integration tests, and Python fast-path files such as [[json2xml/backend_selector.py]] and [[json2xml/dicttoxml_fast.py]]. That keeps native backend tests attached to the Python dispatch code that decides whether the accelerator is used.