diff --git a/.claude/skills/setup-agent-team/refactor.sh b/.claude/skills/setup-agent-team/refactor.sh
index 107ee808..d04ebb3d 100755
--- a/.claude/skills/setup-agent-team/refactor.sh
+++ b/.claude/skills/setup-agent-team/refactor.sh
@@ -221,7 +221,9 @@ log "Hard timeout: ${HARD_TIMEOUT}s"
 
 # Run claude in background, output goes to log file.
 # The trigger server is fire-and-forget — VM keep-alive is handled by systemd.
-claude -p "$(cat "${PROMPT_FILE}")" >> "${LOG_FILE}" 2>&1 &
+# Team lead uses Sonnet — coordination (spawn, monitor, shutdown) doesn't need
+# Opus-level reasoning and Sonnet output tokens are 5x cheaper.
+claude -p "$(cat "${PROMPT_FILE}")" --model sonnet >> "${LOG_FILE}" 2>&1 &
 CLAUDE_PID=$!
 log "Claude started (pid=${CLAUDE_PID})"
 
diff --git a/.claude/skills/setup-agent-team/security.sh b/.claude/skills/setup-agent-team/security.sh
index b9fbbecb..c47345bb 100644
--- a/.claude/skills/setup-agent-team/security.sh
+++ b/.claude/skills/setup-agent-team/security.sh
@@ -320,8 +320,12 @@ HARD_TIMEOUT=$((CYCLE_TIMEOUT + 300))
 log "Hard timeout: ${HARD_TIMEOUT}s"
 
 # Run claude in background, output goes to log file.
-# Triage uses gemini-3-flash (lightweight safety check); other modes use default (Opus) for team lead.
-CLAUDE_MODEL_FLAG=""
+# Triage uses gemini-3-flash (lightweight safety check).
+# All other modes use Sonnet for the team lead — the lead's job is coordination
+# (spawn teammates, monitor, shut down), not deep reasoning. Opus is 5x more
+# expensive on output tokens and the quality difference for coordination is
+# negligible. Teammates (spawned by the lead) use their own model flags.
+CLAUDE_MODEL_FLAG="--model sonnet"
 if [[ "${RUN_MODE}" == "triage" ]]; then
     CLAUDE_MODEL_FLAG="--model google/gemini-3-flash-preview"
 fi
diff --git a/.github/workflows/refactor.yml b/.github/workflows/refactor.yml
index 448e2aa0..b5d4ef02 100644
--- a/.github/workflows/refactor.yml
+++ b/.github/workflows/refactor.yml
@@ -2,7 +2,7 @@ name: Trigger Refactor
 
 on:
   schedule:
-    - cron: '*/15 * * * *'
+    - cron: '0 */2 * * *'
   issues:
     types: [opened, reopened, labeled]
   workflow_dispatch:
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 9fd1e05a..59ed58ba 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -4,7 +4,7 @@ on:
   issues:
     types: [opened, reopened, labeled]
   schedule:
-    - cron: '*/30 * * * *'
+    - cron: '0 */4 * * *'
   workflow_dispatch:
 
 jobs: