diff --git a/.github/workflows/opencode.yml b/.github/workflows/opencode.yml
index 5056bcbeee..a67d201888 100644
--- a/.github/workflows/opencode.yml
+++ b/.github/workflows/opencode.yml
@@ -26,10 +26,18 @@ jobs:
       authorized: ${{ steps.check.outputs.authorized }}
 
     steps:
+      - name: Mint Token
+        id: auth-token
+        uses: actions/create-github-app-token@v3.2.0
+        with:
+          client-id: ${{ vars.LYRA_CLIENT_ID }}
+          private-key: ${{ secrets.LYRA_PRIVATE_KEY }}
+          permission-administration: read
+    
       - name: Check Write Permission
         id: check
         env:
-          GH_TOKEN: ${{ secrets.PAT_ADMIN_READ }}
+          GH_TOKEN: ${{ steps.auth-token.outputs.token }}
           ACTOR: ${{ github.actor }}
         run: |
           if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
@@ -57,10 +65,20 @@ jobs:
     timeout-minutes: 30
 
     steps:
+      - name: Mint Issues Token
+        id: issues-token
+        uses: actions/create-github-app-token@v3.2.0
+        with:
+          client-id: ${{ vars.LYRA_CLIENT_ID }}
+          private-key: ${{ secrets.LYRA_PRIVATE_KEY }}
+          permission-issues: write
+          permission-pull-requests: write
+          permission-contents: read
+
       - name: Acknowledge Command
         if: github.event_name != 'workflow_dispatch'
         env:
-          GH_TOKEN: ${{ secrets.LYRA_CONTENTS_PRS_ISSUES_PAT }}
+          GH_TOKEN: ${{ steps.issues-token.outputs.token }}
           COMMENT_ID: ${{ github.event.comment.id }}
           EVENT_NAME: ${{ github.event_name }}
         run: |
@@ -77,9 +95,10 @@ jobs:
       - name: Prepare Workspace & Context
         id: context
         env:
-          GH_TOKEN: ${{ secrets.LYRA_CONTENTS_PRS_ISSUES_PAT }}
+          GH_TOKEN: ${{ steps.issues-token.outputs.token }}
           EVENT_NAME: ${{ github.event_name }}
           INPUT_PROMPT: ${{ inputs.prompt }}
+          SLUG: ${{ steps.issues-token.outputs.app-slug }}
         run: |
           IS_PR="false"
           if jq -e '.issue.pull_request // .pull_request' "$GITHUB_EVENT_PATH" > /dev/null; then
@@ -133,8 +152,12 @@ jobs:
           fi
           echo "branch=$BRANCH_NAME" >> "$GITHUB_OUTPUT"
 
-          git config user.name "lyra-the-bot"
-          git config user.email "lyra-the-bot@users.noreply.github.com"
+          BOT_NAME="${SLUG}[bot]"
+          BOT_USER_ID=$(gh api "users/${BOT_NAME}" --jq .id)
+
+          git config user.name "$BOT_NAME"
+          git config user.email "${BOT_USER_ID}+${BOT_NAME}@users.noreply.github.com"
+
           echo "base_sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
 
           # Diff context for review comments
@@ -210,7 +233,7 @@ jobs:
       - name: Empty Prompt Hint
         if: steps.context.outputs.empty == 'true' && github.event_name != 'workflow_dispatch'
         env:
-          GH_TOKEN: ${{ secrets.LYRA_CONTENTS_PRS_ISSUES_PAT }}
+          GH_TOKEN: ${{ steps.issues-token.outputs.token }}
           TARGET_NUM: ${{ steps.context.outputs.num }}
         run: |
           if [ -n "$TARGET_NUM" ]; then
@@ -238,11 +261,20 @@ jobs:
         run: |
           opencode run -m "$OPENCODE_MAIN_MODEL" --variant xhigh < /tmp/prompt.txt > /tmp/opencode_output.txt
 
+      - name: Mint Contents Token
+        if: steps.context.outputs.empty != 'true' && steps.opencode.outcome == 'success'
+        id: contents-token
+        uses: actions/create-github-app-token@v3.2.0
+        with:
+          client-id: ${{ vars.LYRA_CLIENT_ID }}
+          private-key: ${{ secrets.LYRA_PRIVATE_KEY }}
+          permission-contents: write
+
       - name: Sync Results & Respond
         if: steps.context.outputs.empty != 'true' && steps.opencode.outcome == 'success'
         env:
-          GH_TOKEN: ${{ secrets.LYRA_CONTENTS_PRS_ISSUES_PAT }}
-          PUSH_TOKEN: ${{ secrets.PAT_CONTENTS_WRITE }}
+          GH_TOKEN: ${{ steps.issues-token.outputs.token }}
+          PUSH_TOKEN: ${{ steps.contents-token.outputs.token }}
           IS_PR: ${{ steps.context.outputs.is_pr }}
           TARGET_NUM: ${{ steps.context.outputs.num }}
           BRANCH_NAME: ${{ steps.context.outputs.branch }}
@@ -316,7 +348,7 @@ jobs:
       - name: Report Failure
         if: failure() && github.event_name != 'workflow_dispatch'
         env:
-          GH_TOKEN: ${{ secrets.LYRA_CONTENTS_PRS_ISSUES_PAT }}
+          GH_TOKEN: ${{ steps.issues-token.outputs.token }}
         run: |
           NUM=$(jq -r '.issue.number // .pull_request.number // empty' "$GITHUB_EVENT_PATH")
           if [ -n "$NUM" ]; then
@@ -326,7 +358,7 @@ jobs:
       - name: Remove Eyes Reaction
         if: always() && github.event_name != 'workflow_dispatch'
         env:
-          GH_TOKEN: ${{ secrets.LYRA_CONTENTS_PRS_ISSUES_PAT }}
+          GH_TOKEN: ${{ steps.issues-token.outputs.token }}
           COMMENT_ID: ${{ github.event.comment.id }}
           EVENT_NAME: ${{ github.event_name }}
         run: |
diff --git a/.github/workflows/opencode_issue_triage.yml b/.github/workflows/opencode_issue_triage.yml
index d311dda082..a93a801e31 100644
--- a/.github/workflows/opencode_issue_triage.yml
+++ b/.github/workflows/opencode_issue_triage.yml
@@ -31,11 +31,21 @@ jobs:
       issues: read
 
     steps:
+      - name: Mint Issues Token
+        id: issues-token
+        uses: actions/create-github-app-token@v3.2.0
+        with:
+          client-id: ${{ vars.LYRA_CLIENT_ID }}
+          private-key: ${{ secrets.LYRA_PRIVATE_KEY }}
+          permission-issues: write
+          permission-pull-requests: write
+          permission-contents: read
+
       - name: Acknowledge Command
         if: github.event_name == 'issue_comment'
         env:
-          GITHUB_TOKEN: ${{ secrets.LYRA_PRS_ISSUES_PAT }}
-          GH_TOKEN: ${{ secrets.LYRA_PRS_ISSUES_PAT }}
+          GITHUB_TOKEN: ${{ steps.issues-token.outputs.token }}
+          GH_TOKEN: ${{ steps.issues-token.outputs.token }}
           COMMENT_ID: ${{ github.event.comment.id }}
         run: |
           gh api repos/${{ github.repository }}/issues/comments/${COMMENT_ID}/reactions -f content='eyes'
@@ -132,8 +142,8 @@ jobs:
       - name: Apply Triage Plan
         env:
           ISSUE_NUMBER: ${{ github.event.issue.number }}
-          GITHUB_TOKEN: ${{ secrets.LYRA_PRS_ISSUES_PAT }}
-          GH_TOKEN: ${{ secrets.LYRA_PRS_ISSUES_PAT }}
+          GITHUB_TOKEN: ${{ steps.issues-token.outputs.token }}
+          GH_TOKEN: ${{ steps.issues-token.outputs.token }}
         run: |
           if [ ! -f /tmp/triage_plan.json ]; then
             echo "::error::Triage plan /tmp/triage_plan.json was not generated."
@@ -288,8 +298,8 @@ jobs:
       - name: Post Investigation Comment
         env:
           ISSUE_NUMBER: ${{ github.event.issue.number }}
-          GITHUB_TOKEN: ${{ secrets.LYRA_PRS_ISSUES_PAT }}
-          GH_TOKEN: ${{ secrets.LYRA_PRS_ISSUES_PAT }}
+          GITHUB_TOKEN: ${{ steps.issues-token.outputs.token }}
+          GH_TOKEN: ${{ steps.issues-token.outputs.token }}
         run: |
           if [ -s /tmp/investigation.md ]; then
             echo "Posting investigation findings to issue #${ISSUE_NUMBER}..."
diff --git a/.github/workflows/opencode_review.yml b/.github/workflows/opencode_review.yml
index 1410cbadba..b64a5cbaf8 100644
--- a/.github/workflows/opencode_review.yml
+++ b/.github/workflows/opencode_review.yml
@@ -20,7 +20,7 @@ jobs:
         contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
       ) || (
         github.event_name == 'pull_request_target' &&
-        github.event.requested_reviewer.login == 'lyra-the-bot'
+        github.event.requested_reviewer.login == format('{0}[bot]', vars.LYRA_SLUG)
       )
 
     runs-on: ubuntu-latest
@@ -29,11 +29,21 @@ jobs:
       pull-requests: write
 
     steps:
+      - name: Mint Issues Token
+        id: issues-token
+        uses: actions/create-github-app-token@v3.2.0
+        with:
+          client-id: ${{ vars.LYRA_CLIENT_ID }}
+          private-key: ${{ secrets.LYRA_PRIVATE_KEY }}
+          permission-issues: write
+          permission-pull-requests: write
+          permission-contents: read
+    
       - name: Acknowledge Command
         if: github.event_name == 'issue_comment'
         env:
-          GITHUB_TOKEN: ${{ secrets.LYRA_PRS_ISSUES_PAT }}
-          GH_TOKEN: ${{ secrets.LYRA_PRS_ISSUES_PAT }}
+          GITHUB_TOKEN: ${{ steps.issues-token.outputs.token }}
+          GH_TOKEN: ${{ steps.issues-token.outputs.token }}
           COMMENT_ID: ${{ github.event.comment.id }}
         run: |
           gh api repos/${{ github.repository }}/issues/comments/${COMMENT_ID}/reactions -f content='eyes'
@@ -56,12 +66,12 @@ jobs:
           gh pr checkout ${{ steps.pr-number.outputs.number }}
           echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
         env:
-          GH_TOKEN: ${{ secrets.LYRA_PRS_ISSUES_PAT }}
+          GH_TOKEN: ${{ steps.issues-token.outputs.token }}
 
       - name: Get PR details
         id: pr-details
         env:
-          GH_TOKEN: ${{ secrets.LYRA_PRS_ISSUES_PAT }}
+          GH_TOKEN: ${{ steps.issues-token.outputs.token }}
           PR_NUM: ${{ steps.pr-number.outputs.number }}
         run: |
           # 1. Fetch PR details
@@ -126,8 +136,8 @@ jobs:
         if: steps.pr-details.outputs.review_mode != 'NO_CHANGES'
         env:
           OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
-          GH_TOKEN: ${{ secrets.LYRA_PRS_ISSUES_PAT }}
-          GITHUB_TOKEN: ${{ secrets.LYRA_PRS_ISSUES_PAT }}
+          GH_TOKEN: ${{ steps.issues-token.outputs.token }}
+          GITHUB_TOKEN: ${{ steps.issues-token.outputs.token }}
           OPENCODE_PERMISSION: '{ "external_directory": { "/home/runner/work/**": "allow", "/tmp/*": "allow" } }'
           PR_TITLE: ${{ steps.pr-details.outputs.title }}
           PR_SHA: ${{ steps.pr-git.outputs.sha }}