diff --git a/.github/workflows/opencode.yml b/.github/workflows/opencode.yml
index 91d9d3b..af6540b 100644
--- a/.github/workflows/opencode.yml
+++ b/.github/workflows/opencode.yml
@@ -13,12 +13,14 @@ concurrency:
 jobs:
   opencode:
     if: |
-      contains(github.event.comment.body, '/oc') ||
-      contains(github.event.comment.body, '/opencode')
+      !endsWith(github.event.comment.user.login, '[bot]') &&
+      (
+        startsWith(github.event.comment.body, '/oc') ||
+        startsWith(github.event.comment.body, '/opencode')
+      )
     runs-on: ubuntu-latest
     timeout-minutes: 45
     permissions:
-      id-token: write
       contents: write
       issues: write
       pull-requests: write
@@ -53,10 +55,10 @@ jobs:
         uses: anomalyco/opencode/github@cb7d8b2f5e44876ef98b661dc10590c915af3a9f
         env:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-          GITHUB_TOKEN: ${{ secrets.SECTL_SECAGENT_GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
         with:
           model: deepseek/deepseek-v4-flash
           agent: issue-pr-coder
           mentions: /oc,/opencode
           variant: medium
-          use_github_token: false
+          use_github_token: true