diff --git a/.github/workflows/integrations-add-to-project.yml b/.github/workflows/integrations-add-to-project.yml
index 70453b8..c5a6777 100644
--- a/.github/workflows/integrations-add-to-project.yml
+++ b/.github/workflows/integrations-add-to-project.yml
@@ -9,12 +9,27 @@ on:
     types:
       - opened
 
+permissions: {}
+
 jobs:
   add-to-project:
     name: Add issue to project
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/add-to-project@v1.0.2
+      # GITHUB_TOKEN has no permission on an organization project, so the token
+      # comes from the installation of a GitHub App on the project's
+      # organization. The issue or pull request is public, so the token needs no
+      # permission on this repository to read it.
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ vars.ADD_TO_PROJECT_APP_ID }}
+          private-key: ${{ secrets.ADD_TO_PROJECT_APP_PRIVATE_KEY }}
+          owner: FiligranHQ
+          permission-organization-projects: write
+
+      - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
         with:
-          project-url: ${{ vars.PROJECT_URL }}
-          github-token: ${{ secrets.ADD_TO_PROJECT_PAT }}
+          project-url: ${{ vars.XTM_INTEGRATIONS_PROJECT_URL }}
+          github-token: ${{ steps.app-token.outputs.token }}