diff --git a/.github/scripts/src/build-image/index.ts b/.github/scripts/src/build-image/index.ts
index bdbb4a7..64395d5 100644
--- a/.github/scripts/src/build-image/index.ts
+++ b/.github/scripts/src/build-image/index.ts
@@ -65,7 +65,12 @@ async function main() {
   });
 
   if (prId) {
-    const ghClient = await GitHubClient.createWithDefaultCiToken();
+    const ghClient = await GitHubClient.createWithGithubAppToken({
+      appId: requiredEnv("_GITHUB_APP_APP_ID"),
+      installationId: requiredEnv("_GITHUB_APP_INSTALLATION_ID"),
+      privateKey: requiredEnv("_GITHUB_APP_PEM_CONTENT"),
+    });
+
     await ghClient.sendPrMessage({
       prId: Number(prId),
       owner: GITHUB_OWNER,
diff --git a/.github/scripts/src/consts.ts b/.github/scripts/src/consts.ts
index d7e6558..fa6a5dd 100644
--- a/.github/scripts/src/consts.ts
+++ b/.github/scripts/src/consts.ts
@@ -2,6 +2,12 @@ export const GITHUB_OWNER = "Patina-Network";
 export const GITHUB_REPOSITORY = "hello-world-grpc-client-java";
 const DOCKER_REPOSITORY = "hello-world-client-java";
 
+/** Repo under GITHUB_OWNER that `deploy` opens image-tag PRs against. */
+export const K8S_MANIFESTS_REPOSITORY = "k8s-manifests";
+
+export const SONAR_ORGANIZATION = "patina-network";
+export const SONAR_PROJECT_KEY = `${GITHUB_OWNER}_${GITHUB_REPOSITORY}`;
+
 export const ARCHITECTURES = ["amd64", "arm64"] as const;
 export type Architecture = (typeof ARCHITECTURES)[number];
 
diff --git a/.github/scripts/src/deploy/index.ts b/.github/scripts/src/deploy/index.ts
index 1d8cd2e..9f474fe 100644
--- a/.github/scripts/src/deploy/index.ts
+++ b/.github/scripts/src/deploy/index.ts
@@ -6,6 +6,7 @@ import {
   dockerRepository,
   GITHUB_OWNER,
   GITHUB_REPOSITORY,
+  K8S_MANIFESTS_REPOSITORY,
   requiredEnv,
   shortSha,
 } from "../consts";
@@ -50,10 +51,10 @@ async function main() {
 
   const repository = dockerRepository();
   await ghClient.updateK8sTagWithPR({
-    manifestRepo: [GITHUB_OWNER, "k8s-manifests"],
+    manifestRepo: [GITHUB_OWNER, K8S_MANIFESTS_REPOSITORY],
     originRepo: [GITHUB_OWNER, GITHUB_REPOSITORY],
     kustomizationFilePath: `base/${environment}/${repository}/kustomization.yaml`,
-    imageName: `patinanetwork/${dockerRepository("arm64")}`,
+    imageName: `${requiredEnv("DOCKER_HUB_USERNAME")}/${dockerRepository("arm64")}`,
     newTag: version,
     environment,
   });
diff --git a/.github/scripts/src/test/index.ts b/.github/scripts/src/test/index.ts
index 0e02097..f60dcea 100644
--- a/.github/scripts/src/test/index.ts
+++ b/.github/scripts/src/test/index.ts
@@ -2,6 +2,7 @@ import { SonarScannerClient } from "@tahminator/pipeline";
 import { $ } from "bun";
 
 import { exclusions } from "../../../../exclusions";
+import { SONAR_ORGANIZATION, SONAR_PROJECT_KEY } from "../consts";
 
 async function main() {
   const { sonarToken } = parseCiEnv(process.env);
@@ -18,9 +19,9 @@ async function main() {
         "coverage.jacoco.xmlReportPaths": "target/site/jacoco/jacoco.xml",
         "coverage.exclusions": `${exclusions}`,
       },
-      organization: "patina-network",
+      organization: SONAR_ORGANIZATION,
       sourceCodeDir: "src/main/java",
-      projectKey: "Patina-Network_hello-world-grpc-client-java",
+      projectKey: SONAR_PROJECT_KEY,
     },
     run: {
       runTestsCmd: $`mvn -B -ntp verify`,
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d233f42..ab0ea24 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -50,10 +50,6 @@ jobs:
       github.ref_name == 'main' ||
       github.event.pull_request.head.repo.full_name == github.repository
 
-    permissions:
-      contents: read
-      pull-requests: write
-
     strategy:
       fail-fast: false
       matrix: