diff --git a/get-shit-done/workflows/forensics.md b/get-shit-done/workflows/forensics.md
index caa5d765e..07e1c60c4 100644
--- a/get-shit-done/workflows/forensics.md
+++ b/get-shit-done/workflows/forensics.md
@@ -244,13 +244,14 @@ If actionable anomalies were found (HIGH or MEDIUM confidence):
 If confirmed:
 ```bash
 # Check if "bug" label exists before using it
-BUG_LABEL=$(gh label list --search "bug" --json name -q '.[0].name' 2>/dev/null)
+BUG_LABEL=$(gh label list --repo gsd-build/get-shit-done --search "bug" --json name -q '.[0].name' 2>/dev/null)
 LABEL_FLAG=""
 if [ -n "$BUG_LABEL" ]; then
   LABEL_FLAG="--label bug"
 fi
 
 gh issue create \
+  --repo gsd-build/get-shit-done \
   --title "bug: {concise description from anomaly}" \
   $LABEL_FLAG \
   --body "{formatted findings from report}"
diff --git a/tests/forensics.test.cjs b/tests/forensics.test.cjs
index d0caf75a3..a9e14dc69 100644
--- a/tests/forensics.test.cjs
+++ b/tests/forensics.test.cjs
@@ -138,6 +138,28 @@ describe('forensics workflow', () => {
     );
   });
 
+  test('workflow submits issues to gsd-build/get-shit-done, not the current repo', () => {
+    const content = fs.readFileSync(workflowPath, 'utf-8');
+    // Scope check to the gh issue create invocation — a whole-file search would
+    // pass even if gh issue create lacked --repo, because gh label list also
+    // contains the repo string.
+    assert.match(
+      content,
+      /gh issue create[\s\S]{0,250}--repo\s+gsd-build\/get-shit-done/,
+      'gh issue create must use --repo gsd-build/get-shit-done to avoid submitting to the user\'s current project repo'
+    );
+  });
+
+  test('workflow checks bug label in gsd-build/get-shit-done, not the current repo', () => {
+    const content = fs.readFileSync(workflowPath, 'utf-8');
+    // Regex is more robust than a fixed-length slice to formatting changes
+    assert.match(
+      content,
+      /gh label list[\s\S]{0,250}--repo\s+gsd-build\/get-shit-done/,
+      'gh label list must target gsd-build/get-shit-done'
+    );
+  });
+
   test('workflow updates STATE.md', () => {
     const content = fs.readFileSync(workflowPath, 'utf-8');
     assert.ok(