diff --git a/kubernetes/infrastructure/openbao/rotation/review-bot.yaml b/kubernetes/infrastructure/openbao/rotation/review-bot.yaml
index 2b57aef6..69ebcf59 100644
--- a/kubernetes/infrastructure/openbao/rotation/review-bot.yaml
+++ b/kubernetes/infrastructure/openbao/rotation/review-bot.yaml
@@ -111,8 +111,9 @@ spec:
                 # push, or repoint this at another private repo it collaborates on.
                 - name: GITEA_VERIFY_REPO
                   value: konairius/shelly-manager
+                # read:issue: the sweep lists requested reviews via /repos/issues/search.
                 - name: GITEA_SCOPES
-                  value: write:repository
+                  value: write:repository,read:issue
                 # review-bot posts reviews via the API (write:repository scope)
                 # but never git-pushes, and is only a read collaborator, so push
                 # verification would fail. The private-repo pull check above is