diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index 4879d09a..0d29a57b 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -9,10 +9,29 @@ jobs:
   integration-tests:
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    permissions: {}
     steps:
+      # Token lives ~1h, comfortably longer than this job's timeout, so one mint covers all steps.
+      - name: Generate CI token
+        id: codeql-ci-app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ vars.CODEQL_CI_APP_CLIENT_ID }}
+          owner: github
+          permission-actions: read # GET actions/runs
+          permission-contents: write # create/read variant analyses
+          private-key: ${{ secrets.CODEQL_CI_APP_PRIVATE_KEY }}
+          repositories: |-
+            codeql-variant-analysis-action
+
       - name: Trigger variant analysis
         id: trigger
         run: |
+          # Deliberately the PR head ref, so the test exercises this PR's action code, not main's.
+          # Non-main refs require the calling actor to hold the mrva_allow_non_default_action_ref
+          # feature flag; codeql-ci-app[bot] is enrolled. If a run fails with "Invalid ref provided",
+          # check that enrolment — do not pin REF to main to go green, as the test would then pass
+          # while no longer testing this PR's code.
           if [ "$GITHUB_EVENT_NAME" == "pull_request" ]; then
             REF="$GITHUB_HEAD_REF"
           else
@@ -35,7 +54,7 @@ jobs:
           EOF
           echo "input.json: $(cat input.json)"
 
-          RESPONSE=$(curl --no-progress-meter -H "Authorization: Bearer ${{ secrets.BOT_TOKEN }}" "https://api.github.com/repos/$GITHUB_REPOSITORY/code-scanning/codeql/variant-analyses" -X POST -d @input.json)
+          RESPONSE=$(curl --no-progress-meter -H "Authorization: Bearer ${{ steps.codeql-ci-app-token.outputs.token }}" "https://api.github.com/repos/$GITHUB_REPOSITORY/code-scanning/codeql/variant-analyses" -X POST -d @input.json)
           echo "Response: $RESPONSE"
 
           ID="$(echo "$RESPONSE" | jq '.id')"
@@ -51,7 +70,7 @@ jobs:
       - name: Wait for variant analysis to complete
         run: |
           while true; do
-            RESPONSE=$(curl --no-progress-meter -H "Authorization: Bearer ${{ secrets.BOT_TOKEN }}" "https://api.github.com/repos/$GITHUB_REPOSITORY/code-scanning/codeql/variant-analyses/${{ steps.trigger.outputs.variant_analysis_id }}")
+            RESPONSE=$(curl --no-progress-meter -H "Authorization: Bearer ${{ steps.codeql-ci-app-token.outputs.token }}" "https://api.github.com/repos/$GITHUB_REPOSITORY/code-scanning/codeql/variant-analyses/${{ steps.trigger.outputs.variant_analysis_id }}")
             STATUS="$(echo "$RESPONSE" | jq '.status' -r)"
             ACTIONS_WORKFLOW_RUN_ID="$(echo "$RESPONSE" | jq '.actions_workflow_run_id' -r)"
             echo "Variant analysis ${{ steps.trigger.outputs.variant_analysis_id }} status: $STATUS"
@@ -68,7 +87,7 @@ jobs:
       - name: Validate variant analysis status
         id: validate
         run: |
-          RESPONSE=$(curl --no-progress-meter -H "Authorization: Bearer ${{ secrets.BOT_TOKEN }}" "https://api.github.com/repos/$GITHUB_REPOSITORY/code-scanning/codeql/variant-analyses/${{ steps.trigger.outputs.variant_analysis_id }}")
+          RESPONSE=$(curl --no-progress-meter -H "Authorization: Bearer ${{ steps.codeql-ci-app-token.outputs.token }}" "https://api.github.com/repos/$GITHUB_REPOSITORY/code-scanning/codeql/variant-analyses/${{ steps.trigger.outputs.variant_analysis_id }}")
           echo "Response: $RESPONSE"
           echo "Actions workflow URL: $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$(echo "$RESPONSE" | jq '.actions_workflow_run_id')"
 
@@ -132,7 +151,7 @@ jobs:
             exit 1
           fi
 
-          ACTIONS_RESPONSE=$(curl --no-progress-meter -H "Authorization: Bearer ${{ secrets.BOT_TOKEN }}" "https://api.github.com/repos/$GITHUB_REPOSITORY/actions/runs/$(echo "$RESPONSE" | jq '.actions_workflow_run_id')")
+          ACTIONS_RESPONSE=$(curl --no-progress-meter -H "Authorization: Bearer ${{ steps.codeql-ci-app-token.outputs.token }}" "https://api.github.com/repos/$GITHUB_REPOSITORY/actions/runs/$(echo "$RESPONSE" | jq '.actions_workflow_run_id')")
 
           if [ "$(echo "$ACTIONS_RESPONSE" | jq '.status' -r)" != "completed" ]; then
             echo "Actions workflow status is not completed"