diff --git a/.github/workflows/devflow-pr-review.yml b/.github/workflows/devflow-pr-review.yml
index f3d59fb8615..47d3831999b 100644
--- a/.github/workflows/devflow-pr-review.yml
+++ b/.github/workflows/devflow-pr-review.yml
@@ -81,13 +81,13 @@ jobs:
         uses: ./.github/actions/github-app-token
         with:
           mode: ${{ vars.GH_APP_AUTH_MODE }}
-          azure-client-id: ${{ vars.GH_APP_AZURE_CLIENT_ID }}
-          azure-tenant-id: ${{ vars.GH_APP_AZURE_TENANT_ID }}
-          azure-subscription-id: ${{ vars.GH_APP_AZURE_SUBSCRIPTION_ID }}
-          key-vault-name: ${{ vars.GH_APP_KEY_VAULT_NAME }}
-          key-name: ${{ vars.GH_APP_KEY_NAME }}
-          github-app-client-id: ${{ vars.GH_APP_CLIENT_ID }}
-          github-app-installation-id: ${{ vars.GH_APP_INSTALLATION_ID }}
+          azure-client-id: ${{ secrets.GH_APP_AZURE_CLIENT_ID }}
+          azure-tenant-id: ${{ secrets.GH_APP_AZURE_TENANT_ID }}
+          azure-subscription-id: ${{ secrets.GH_APP_AZURE_SUBSCRIPTION_ID }}
+          key-vault-name: ${{ secrets.GH_APP_KEY_VAULT_NAME }}
+          key-name: ${{ secrets.GH_APP_KEY_NAME }}
+          github-app-client-id: ${{ secrets.GH_APP_CLIENT_ID }}
+          github-app-installation-id: ${{ secrets.GH_APP_INSTALLATION_ID }}
           repository: ${{ github.repository }}
           fallback-token: ${{ secrets.GH_ACTIONS_PR_WRITE }}
 
@@ -119,6 +119,11 @@ jobs:
     runs-on: ubuntu-latest
     needs: team_check
     if: ${{ needs.team_check.outputs.is_team_member == 'true' }}
+    permissions:
+      contents: read
+      copilot-requests: write
+      issues: write
+      pull-requests: write
     timeout-minutes: 60
     # Advisory check: failures here should not block the PR. The reviewer
     # posts comments as a best-effort signal; if the pipeline breaks, the
@@ -166,7 +171,7 @@ jobs:
         working-directory: ${{ env.DEVFLOW_PATH }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_COPILOT_TOKEN: ${{ secrets.GH_COPILOT_TOKEN }}
+          GH_COPILOT_TOKEN: ${{ github.token }}
           SK_REPO_PATH: ${{ env.TARGET_REPO_PATH }}
           AGENT_REPO_PATH: ${{ env.TARGET_REPO_PATH }}
           PR_URL: ${{ needs.team_check.outputs.pr_url }}
diff --git a/.github/workflows/issue-triage.yml b/.github/workflows/issue-triage.yml
index 60184def0e6..fa49c5759c7 100644
--- a/.github/workflows/issue-triage.yml
+++ b/.github/workflows/issue-triage.yml
@@ -80,13 +80,13 @@ jobs:
         uses: ./.github/actions/github-app-token
         with:
           mode: ${{ vars.GH_APP_AUTH_MODE }}
-          azure-client-id: ${{ vars.GH_APP_AZURE_CLIENT_ID }}
-          azure-tenant-id: ${{ vars.GH_APP_AZURE_TENANT_ID }}
-          azure-subscription-id: ${{ vars.GH_APP_AZURE_SUBSCRIPTION_ID }}
-          key-vault-name: ${{ vars.GH_APP_KEY_VAULT_NAME }}
-          key-name: ${{ vars.GH_APP_KEY_NAME }}
-          github-app-client-id: ${{ vars.GH_APP_CLIENT_ID }}
-          github-app-installation-id: ${{ vars.GH_APP_INSTALLATION_ID }}
+          azure-client-id: ${{ secrets.GH_APP_AZURE_CLIENT_ID }}
+          azure-tenant-id: ${{ secrets.GH_APP_AZURE_TENANT_ID }}
+          azure-subscription-id: ${{ secrets.GH_APP_AZURE_SUBSCRIPTION_ID }}
+          key-vault-name: ${{ secrets.GH_APP_KEY_VAULT_NAME }}
+          key-name: ${{ secrets.GH_APP_KEY_NAME }}
+          github-app-client-id: ${{ secrets.GH_APP_CLIENT_ID }}
+          github-app-installation-id: ${{ secrets.GH_APP_INSTALLATION_ID }}
           repository: ${{ github.repository }}
           fallback-token: ${{ secrets.GH_ACTIONS_PR_WRITE }}
 
@@ -124,6 +124,11 @@ jobs:
         || needs.team_check.outputs.is_team_member == 'false'
       }}
     environment: integration
+    permissions:
+      contents: read
+      copilot-requests: write
+      id-token: write
+      issues: write
     timeout-minutes: 60
 
     steps:
@@ -198,7 +203,7 @@ jobs:
         working-directory: ${{ env.DEVFLOW_PATH }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_COPILOT_TOKEN: ${{ secrets.GH_COPILOT_TOKEN }}
+          GH_COPILOT_TOKEN: ${{ github.token }}
           # Not seen by the agent prompt; used only to push a paper-trail
           # branch back to maf-dashboard at run end.
           DEVFLOW_TOKEN: ${{ secrets.DEVFLOW_TOKEN }}
diff --git a/.github/workflows/label-issues.yml b/.github/workflows/label-issues.yml
index f4f6f230678..8c8d4e793fc 100644
--- a/.github/workflows/label-issues.yml
+++ b/.github/workflows/label-issues.yml
@@ -30,13 +30,13 @@ jobs:
         uses: ./.github/actions/github-app-token
         with:
           mode: ${{ vars.GH_APP_AUTH_MODE }}
-          azure-client-id: ${{ vars.GH_APP_AZURE_CLIENT_ID }}
-          azure-tenant-id: ${{ vars.GH_APP_AZURE_TENANT_ID }}
-          azure-subscription-id: ${{ vars.GH_APP_AZURE_SUBSCRIPTION_ID }}
-          key-vault-name: ${{ vars.GH_APP_KEY_VAULT_NAME }}
-          key-name: ${{ vars.GH_APP_KEY_NAME }}
-          github-app-client-id: ${{ vars.GH_APP_CLIENT_ID }}
-          github-app-installation-id: ${{ vars.GH_APP_INSTALLATION_ID }}
+          azure-client-id: ${{ secrets.GH_APP_AZURE_CLIENT_ID }}
+          azure-tenant-id: ${{ secrets.GH_APP_AZURE_TENANT_ID }}
+          azure-subscription-id: ${{ secrets.GH_APP_AZURE_SUBSCRIPTION_ID }}
+          key-vault-name: ${{ secrets.GH_APP_KEY_VAULT_NAME }}
+          key-name: ${{ secrets.GH_APP_KEY_NAME }}
+          github-app-client-id: ${{ secrets.GH_APP_CLIENT_ID }}
+          github-app-installation-id: ${{ secrets.GH_APP_INSTALLATION_ID }}
           repository: ${{ github.repository }}
           fallback-token: ${{ secrets.GH_ACTIONS_PR_WRITE }}
 
diff --git a/.github/workflows/label-pr.yml b/.github/workflows/label-pr.yml
index eec470bd887..51a275a105f 100644
--- a/.github/workflows/label-pr.yml
+++ b/.github/workflows/label-pr.yml
@@ -36,13 +36,13 @@ jobs:
         uses: ./.github/actions/github-app-token
         with:
           mode: ${{ vars.GH_APP_AUTH_MODE }}
-          azure-client-id: ${{ vars.GH_APP_AZURE_CLIENT_ID }}
-          azure-tenant-id: ${{ vars.GH_APP_AZURE_TENANT_ID }}
-          azure-subscription-id: ${{ vars.GH_APP_AZURE_SUBSCRIPTION_ID }}
-          key-vault-name: ${{ vars.GH_APP_KEY_VAULT_NAME }}
-          key-name: ${{ vars.GH_APP_KEY_NAME }}
-          github-app-client-id: ${{ vars.GH_APP_CLIENT_ID }}
-          github-app-installation-id: ${{ vars.GH_APP_INSTALLATION_ID }}
+          azure-client-id: ${{ secrets.GH_APP_AZURE_CLIENT_ID }}
+          azure-tenant-id: ${{ secrets.GH_APP_AZURE_TENANT_ID }}
+          azure-subscription-id: ${{ secrets.GH_APP_AZURE_SUBSCRIPTION_ID }}
+          key-vault-name: ${{ secrets.GH_APP_KEY_VAULT_NAME }}
+          key-name: ${{ secrets.GH_APP_KEY_NAME }}
+          github-app-client-id: ${{ secrets.GH_APP_CLIENT_ID }}
+          github-app-installation-id: ${{ secrets.GH_APP_INSTALLATION_ID }}
           repository: ${{ github.repository }}
           fallback-token: ${{ secrets.GH_ACTIONS_PR_WRITE }}
 
diff --git a/.github/workflows/limit-community-prs.yml b/.github/workflows/limit-community-prs.yml
index 626e86459ab..6d27af202e0 100644
--- a/.github/workflows/limit-community-prs.yml
+++ b/.github/workflows/limit-community-prs.yml
@@ -41,13 +41,13 @@ jobs:
         uses: ./.github/actions/github-app-token
         with:
           mode: ${{ vars.GH_APP_AUTH_MODE }}
-          azure-client-id: ${{ vars.GH_APP_AZURE_CLIENT_ID }}
-          azure-tenant-id: ${{ vars.GH_APP_AZURE_TENANT_ID }}
-          azure-subscription-id: ${{ vars.GH_APP_AZURE_SUBSCRIPTION_ID }}
-          key-vault-name: ${{ vars.GH_APP_KEY_VAULT_NAME }}
-          key-name: ${{ vars.GH_APP_KEY_NAME }}
-          github-app-client-id: ${{ vars.GH_APP_CLIENT_ID }}
-          github-app-installation-id: ${{ vars.GH_APP_INSTALLATION_ID }}
+          azure-client-id: ${{ secrets.GH_APP_AZURE_CLIENT_ID }}
+          azure-tenant-id: ${{ secrets.GH_APP_AZURE_TENANT_ID }}
+          azure-subscription-id: ${{ secrets.GH_APP_AZURE_SUBSCRIPTION_ID }}
+          key-vault-name: ${{ secrets.GH_APP_KEY_VAULT_NAME }}
+          key-name: ${{ secrets.GH_APP_KEY_NAME }}
+          github-app-client-id: ${{ secrets.GH_APP_CLIENT_ID }}
+          github-app-installation-id: ${{ secrets.GH_APP_INSTALLATION_ID }}
           repository: ${{ github.repository }}
           fallback-token: ${{ secrets.GH_ACTIONS_PR_WRITE }}
 
@@ -96,13 +96,13 @@ jobs:
         uses: ./.github/actions/github-app-token
         with:
           mode: ${{ vars.GH_APP_AUTH_MODE }}
-          azure-client-id: ${{ vars.GH_APP_AZURE_CLIENT_ID }}
-          azure-tenant-id: ${{ vars.GH_APP_AZURE_TENANT_ID }}
-          azure-subscription-id: ${{ vars.GH_APP_AZURE_SUBSCRIPTION_ID }}
-          key-vault-name: ${{ vars.GH_APP_KEY_VAULT_NAME }}
-          key-name: ${{ vars.GH_APP_KEY_NAME }}
-          github-app-client-id: ${{ vars.GH_APP_CLIENT_ID }}
-          github-app-installation-id: ${{ vars.GH_APP_INSTALLATION_ID }}
+          azure-client-id: ${{ secrets.GH_APP_AZURE_CLIENT_ID }}
+          azure-tenant-id: ${{ secrets.GH_APP_AZURE_TENANT_ID }}
+          azure-subscription-id: ${{ secrets.GH_APP_AZURE_SUBSCRIPTION_ID }}
+          key-vault-name: ${{ secrets.GH_APP_KEY_VAULT_NAME }}
+          key-name: ${{ secrets.GH_APP_KEY_NAME }}
+          github-app-client-id: ${{ secrets.GH_APP_CLIENT_ID }}
+          github-app-installation-id: ${{ secrets.GH_APP_INSTALLATION_ID }}
           repository: ${{ github.repository }}
           fallback-token: ${{ secrets.GH_ACTIONS_PR_WRITE }}
 
diff --git a/.github/workflows/stale-issue-pr-ping.yml b/.github/workflows/stale-issue-pr-ping.yml
index 082ae1446f1..373d1978a7f 100644
--- a/.github/workflows/stale-issue-pr-ping.yml
+++ b/.github/workflows/stale-issue-pr-ping.yml
@@ -40,13 +40,13 @@ jobs:
         uses: ./.github/actions/github-app-token
         with:
           mode: ${{ vars.GH_APP_AUTH_MODE }}
-          azure-client-id: ${{ vars.GH_APP_AZURE_CLIENT_ID }}
-          azure-tenant-id: ${{ vars.GH_APP_AZURE_TENANT_ID }}
-          azure-subscription-id: ${{ vars.GH_APP_AZURE_SUBSCRIPTION_ID }}
-          key-vault-name: ${{ vars.GH_APP_KEY_VAULT_NAME }}
-          key-name: ${{ vars.GH_APP_KEY_NAME }}
-          github-app-client-id: ${{ vars.GH_APP_CLIENT_ID }}
-          github-app-installation-id: ${{ vars.GH_APP_INSTALLATION_ID }}
+          azure-client-id: ${{ secrets.GH_APP_AZURE_CLIENT_ID }}
+          azure-tenant-id: ${{ secrets.GH_APP_AZURE_TENANT_ID }}
+          azure-subscription-id: ${{ secrets.GH_APP_AZURE_SUBSCRIPTION_ID }}
+          key-vault-name: ${{ secrets.GH_APP_KEY_VAULT_NAME }}
+          key-name: ${{ secrets.GH_APP_KEY_NAME }}
+          github-app-client-id: ${{ secrets.GH_APP_CLIENT_ID }}
+          github-app-installation-id: ${{ secrets.GH_APP_INSTALLATION_ID }}
           repository: ${{ github.repository }}
           fallback-token: ${{ secrets.GH_ACTIONS_PR_WRITE }}