diff --git a/.github/workflows/auto-label.yml b/.github/workflows/auto-label.yml
index 7bbfba22fb..7d50d52a88 100644
--- a/.github/workflows/auto-label.yml
+++ b/.github/workflows/auto-label.yml
@@ -1,5 +1,8 @@
 name: Auto Label and Add to Project
 
+# pull_request_target is required so the GitHub App secrets are available
+# for PRs from forks. It is safe here: the job never checks out or runs PR
+# code, it only reads ids from the event payload.
 on:
   issues:
     types: [opened]
@@ -18,7 +21,10 @@ jobs:
         with:
           app-id: ${{ secrets.TRIAGE_APP_ID }}
           private-key: ${{ secrets.TRIAGE_APP_PRIVATE_KEY }}
-          owner: penpot
+          # No owner/repositories: the token is scoped to this repository.
+          # Organization permissions (the project board) still apply.
+          permission-issues: write
+          permission-organization-projects: write
 
       - name: Process Issue or PR
         uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
index 6bcbaebf0a..645e3764d8 100644
--- a/.github/zizmor.yml
+++ b/.github/zizmor.yml
@@ -21,10 +21,6 @@ rules:
   dangerous-triggers:
     ignore:
       - auto-label.yml
-  # Scope GitHub App tokens.
-  github-app:
-    ignore:
-      - auto-label.yml
   # Style nudge towards the `$/...` syntax; not worth enforcing.
   self-repository:
     disable: true