diff --git a/.forgejo/kcl-ci/main.k b/.forgejo/kcl-ci/main.k
index d55064e..65634b5 100644
--- a/.forgejo/kcl-ci/main.k
+++ b/.forgejo/kcl-ci/main.k
@@ -267,7 +267,7 @@ Prefer adapter patterns (separate Forgejo files) over inline modifications to up
 The fewer upstream files we modify, the fewer conflicts in the next sync.
 
 ## After merge is resolved and reviewed
-1. Run tests: export GITHUB_SERVER_URL=https://github.com && bun test
+1. Run tests: bun test (GITHUB_SERVER_URL is already set in the environment)
 2. Run typecheck: bun run typecheck
 3. Check formatting: bun run format:check — if issues, fix with bun run format
 4. Commit any remaining changes and push the branch
@@ -541,10 +541,11 @@ fi"""
                         github_token = h.gha_secret("CLAUDE_BOT_TOKEN")
                         platform = "forgejo"
                         show_full_output = "true"
-                        allowed_tools = "Bash,Read,Write,Edit,MultiEdit,Glob,Grep,WebFetch,WebSearch"
+                        allowed_tools = "Bash(git:*),Bash(bun:*),Bash(curl:*),Read,Write,Edit,MultiEdit,Glob,Grep,WebFetch,WebSearch"
                     }
                     env = {
                         GITHUB_TOKEN = h.gha_secret("CLAUDE_BOT_TOKEN")
+                        GITHUB_SERVER_URL = "https://github.com"
                         FORK_MODIFIED_FILES = h.gha_steps("prepare", "fork_files")
                         AFFECTED_FORK_FILES = h.gha_steps("prepare", "affected_files")
                     }
diff --git a/.forgejo/workflows/upstream-sync.yml b/.forgejo/workflows/upstream-sync.yml
index 1c82f7e..dbe9a5a 100644
--- a/.forgejo/workflows/upstream-sync.yml
+++ b/.forgejo/workflows/upstream-sync.yml
@@ -265,7 +265,7 @@ jobs:
           The fewer upstream files we modify, the fewer conflicts in the next sync.
 
           ## After merge is resolved and reviewed
-          1. Run tests: export GITHUB_SERVER_URL=https://github.com && bun test
+          1. Run tests: bun test (GITHUB_SERVER_URL is already set in the environment)
           2. Run typecheck: bun run typecheck
           3. Check formatting: bun run format:check — if issues, fix with bun run format
           4. Commit any remaining changes and push the branch
@@ -282,8 +282,9 @@ jobs:
         github_token: ${{ secrets.CLAUDE_BOT_TOKEN }}
         platform: forgejo
         show_full_output: 'true'
-        allowed_tools: Bash,Read,Write,Edit,MultiEdit,Glob,Grep,WebFetch,WebSearch
+        allowed_tools: Bash(git:*),Bash(bun:*),Bash(curl:*),Read,Write,Edit,MultiEdit,Glob,Grep,WebFetch,WebSearch
       env:
         GITHUB_TOKEN: ${{ secrets.CLAUDE_BOT_TOKEN }}
+        GITHUB_SERVER_URL: https://github.com
         FORK_MODIFIED_FILES: ${{ steps.prepare.outputs.fork_files }}
         AFFECTED_FORK_FILES: ${{ steps.prepare.outputs.affected_files }}