diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
index 7a79575b..c8a8c735 100644
--- a/.github/workflows/cla.yml
+++ b/.github/workflows/cla.yml
@@ -8,7 +8,11 @@ on:
 
 permissions:
   actions: write
-  contents: read
+  # write (not read): CLA Assistant commits signatures/version1/cla.json to the
+  # cla-signatures branch in this repo, so GITHUB_TOKEN needs contents:write.
+  # With read-only it 403s ("Resource not accessible by integration") and the
+  # signature is never recorded even after the contributor signs.
+  contents: write
   pull-requests: write
   statuses: write
 
diff --git a/.github/workflows/greetings.yml b/.github/workflows/greetings.yml
index 7e5797ee..bea15b55 100644
--- a/.github/workflows/greetings.yml
+++ b/.github/workflows/greetings.yml
@@ -11,8 +11,8 @@ jobs:
     steps:
     - uses: actions/first-interaction@v3
       with:
-        repo-token: ${{ secrets.GITHUB_TOKEN }}
-        issue-message: |
+        repo_token: ${{ secrets.GITHUB_TOKEN }}
+        issue_message: |
             Thanks for opening your first issue on **RoboCo**!
 
             To help us triage quickly, please make sure your report includes:
@@ -27,7 +27,7 @@ jobs:
             - **Security vulnerability?** Do **not** open a public issue — please follow [SECURITY.md](../blob/master/SECURITY.md) and use GitHub's private vulnerability reporting.
 
             Thanks again — a maintainer will be with you soon.
-        pr-message: |
+        pr_message: |
             Thanks for opening your first pull request on **RoboCo**!
 
             Quick checklist before review (most of these are enforced by CI, but worth a glance):