diff --git a/sites/scouting/src/matrix.js b/sites/scouting/src/matrix.js
index 6f9ae89..3ca1fa0 100644
--- a/sites/scouting/src/matrix.js
+++ b/sites/scouting/src/matrix.js
@@ -4,15 +4,21 @@
 
    Auth: Google Identity Services (GIS) token client — the viewer signs in
    with their own Google account (a real OAuth popup), no backend, no
-   client secret. Scopes are drive.file (only files this app creates, not
-   full Drive access) and spreadsheets. */
+   client secret. Scopes: drive.file (files this app creates — covers the
+   generated matrix copies and everything written to them afterward) plus
+   drive.readonly (needed for exactly one thing: reading the pre-existing
+   template to copy it — drive.file deliberately can't see a file the app
+   didn't create, which is why the first version of this only requesting
+   drive.file 404'd on the template with no way to even see it existed —
+   Drive's API returns 404, not 403, for a file outside the token's grant,
+   so it looks identical to a bad file ID) and spreadsheets. */
 
 import { detectFormat, parseGwAppV11, parseWarOrganV11, parseV11List, generateDiscordText, buildAbbreviationIndex } from "./vendor/40k-compactor/index.js";
 import skippableWargear from "./vendor/40k-compactor/skippable_wargear.json";
 
 const GOOGLE_CLIENT_ID = "698705216189-rqbg3f7vlosi3077c3n410a7lpmsn16r.apps.googleusercontent.com";
 const TEMPLATE_FILE_ID = "1tSG1BxqLwmMtwFnaHozaLqVsKlmk_QsCXRorIxQBcMo";
-const SCOPES = "https://www.googleapis.com/auth/drive.file https://www.googleapis.com/auth/spreadsheets";
+const SCOPES = "https://www.googleapis.com/auth/drive.file https://www.googleapis.com/auth/drive.readonly https://www.googleapis.com/auth/spreadsheets";
 
 const DRIVE_API = "https://www.googleapis.com/drive/v3";
 const SHEETS_API = "https://sheets.googleapis.com/v4/spreadsheets";