diff --git a/.github/workflows/reusable-agents-issue-bridge.yml b/.github/workflows/reusable-agents-issue-bridge.yml
index 1eb3c498b..f83d50f6e 100644
--- a/.github/workflows/reusable-agents-issue-bridge.yml
+++ b/.github/workflows/reusable-agents-issue-bridge.yml
@@ -36,6 +36,11 @@ on:
         required: false
         type: string
         default: "invite"
+      force_mode:
+        description: "Force mode override (ignore issue event defaults)"
+        required: false
+        type: boolean
+        default: false
       post_agent_comment:
         description: "Auto-post '@<agent> start' command (true/false)"
         required: false
@@ -251,10 +256,14 @@ jobs:
               return;
             }
             const ev = context.eventName;
+            const forceMode = '${{ inputs.force_mode }}' === 'true';
             let mode = '${{ inputs.mode }}' || 'invite';
             let reason = 'input-default';
 
-            if (ev === 'issues') {
+            // If force_mode is enabled, respect the input mode regardless of event type
+            if (forceMode) {
+              reason = 'force-mode-override';
+            } else if (ev === 'issues') {
               const labels = (context.payload.issue && Array.isArray(context.payload.issue.labels)) ? context.payload.issue.labels : [];
               const hasInvite = labels.some((lbl) => String(lbl.name || '').toLowerCase() === `agent:${agent}-invite`);
               const hasBase = labels.some((lbl) => String(lbl.name || '').toLowerCase() === `agent:${agent}`);
diff --git a/templates/consumer-repo/.github/workflows/agents-issue-intake.yml b/templates/consumer-repo/.github/workflows/agents-issue-intake.yml
index 83bd9ee7a..2179042c2 100644
--- a/templates/consumer-repo/.github/workflows/agents-issue-intake.yml
+++ b/templates/consumer-repo/.github/workflows/agents-issue-intake.yml
@@ -175,11 +175,14 @@ jobs:
   sync:
     needs: route
     if: needs.route.outputs.should_run_sync == 'true'
+    permissions:
+      contents: read
+      issues: write
+      id-token: write
+      models: read
     uses: stranske/Workflows/.github/workflows/agents-63-issue-intake.yml@main
     with:
       intake_mode: "chatgpt_sync"
       source: ${{ inputs.topic_files }}
       apply_langchain_formatting: ${{ inputs.apply_langchain_formatting && 'true' || 'false' }}
-    secrets:
-      service_bot_pat: ${{ secrets.SERVICE_BOT_PAT }}
-      owner_pr_pat: ${{ secrets.OWNER_PR_PAT }}
+    secrets: inherit