diff --git a/.github/workflows/build-desktop.yml b/.github/workflows/build-desktop.yml
index 919fe0e6b..64c19cfe0 100644
--- a/.github/workflows/build-desktop.yml
+++ b/.github/workflows/build-desktop.yml
@@ -126,12 +126,11 @@ jobs:
             artifact_suffix: windows
     env:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      # Consumed by scripts/ci-cancel-aware.sh's cancellation watchdog.
+      GH_TOKEN: ${{ github.token }}
       # Keep in sync with DEFAULT_TELEGRAM_BOT_USERNAME_* in channels/controllers/ops.rs
       OPENHUMAN_TELEGRAM_BOT_USERNAME: ${{ inputs.telegram_bot_username }}
       VITE_TELEGRAM_BOT_USERNAME: ${{ inputs.telegram_bot_username }}
-    env:
-      # Consumed by scripts/ci-cancel-aware.sh's cancellation watchdog.
-      GH_TOKEN: ${{ github.token }}
     steps:
       - name: Checkout build ref
         uses: actions/checkout@v5
diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml
index b79cdcbc6..002e5e743 100644
--- a/.github/workflows/pr-ci.yml
+++ b/.github/workflows/pr-ci.yml
@@ -65,12 +65,16 @@ jobs:
 
       - name: Detect changed paths
         id: filter
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@v4
         with:
           list-files: shell
           filters: |
             frontend:
               - '.github/workflows/pr-ci.yml'
+              # The changed-files runner itself must trigger the lane that
+              # runs it (it is also in frontend-full → full-suite mode).
+              - 'scripts/ci/vitest-changed-coverage.sh'
+              - 'scripts/ci-cancel-aware.sh'
               - 'package.json'
               - 'pnpm-lock.yaml'
               - 'app/package.json'
@@ -112,6 +116,9 @@ jobs:
               - 'package.json'
             rust-core:
               - '.github/workflows/pr-ci.yml'
+              # The changed-files runner itself must trigger the lane that
+              # runs it (it is also in rust-core-full → full-suite mode).
+              - 'scripts/ci/rust-coverage-changed.sh'
               - 'Cargo.toml'
               - 'Cargo.lock'
               - 'rust-toolchain.toml'
diff --git a/.github/workflows/prepare-release-pr.yml b/.github/workflows/prepare-release-pr.yml
index 47716f0db..812086ba5 100644
--- a/.github/workflows/prepare-release-pr.yml
+++ b/.github/workflows/prepare-release-pr.yml
@@ -90,7 +90,7 @@ jobs:
       # Use the same GitHub App the release workflows push with.
       - name: Generate GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ secrets.XGITHUB_APP_ID }}
           private-key: ${{ secrets.XGITHUB_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/release-production.yml b/.github/workflows/release-production.yml
index d6ce8f873..87044c4ea 100644
--- a/.github/workflows/release-production.yml
+++ b/.github/workflows/release-production.yml
@@ -119,10 +119,15 @@ jobs:
           exit 1
       - name: Generate GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ secrets.XGITHUB_APP_ID }}
           private-key: ${{ secrets.XGITHUB_APP_PRIVATE_KEY }}
+          # Least privilege: this job only pushes the version-bump commit and
+          # tag (and, on production, the back-merge to main) — contents: write
+          # is all it needs. Branch-protection bypass comes from the App's
+          # identity in the ruleset bypass list, not from token scopes.
+          permission-contents: write
       - name: Checkout release
         uses: actions/checkout@v5
         with:
diff --git a/.github/workflows/release-staging.yml b/.github/workflows/release-staging.yml
index 7cf960307..16ec1c9a1 100644
--- a/.github/workflows/release-staging.yml
+++ b/.github/workflows/release-staging.yml
@@ -94,10 +94,15 @@ jobs:
           exit 1
       - name: Generate GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ secrets.XGITHUB_APP_ID }}
           private-key: ${{ secrets.XGITHUB_APP_PRIVATE_KEY }}
+          # Least privilege: this job only pushes the version-bump commit and
+          # tag (and, on production, the back-merge to main) — contents: write
+          # is all it needs. Branch-protection bypass comes from the App's
+          # identity in the ruleset bypass list, not from token scopes.
+          permission-contents: write
       - name: Checkout release
         uses: actions/checkout@v5
         with: