diff --git a/packages/integration-react/src/api/ScmAuth.test.ts b/packages/integration-react/src/api/ScmAuth.test.ts
index 966a2a0925..2d0ea9b97d 100644
--- a/packages/integration-react/src/api/ScmAuth.test.ts
+++ b/packages/integration-react/src/api/ScmAuth.test.ts
@@ -105,7 +105,7 @@ describe('ScmAuth', () => {
         additionalScope: { repoWrite: true },
       }),
     ).resolves.toMatchObject({
-      token: 'read_user read_api write_repository api',
+      token: 'read_user read_api read_repository write_repository api',
     });
 
     const azureAuth = ScmAuth.forAzure(mockAuthApi);
@@ -120,7 +120,8 @@ describe('ScmAuth', () => {
         additionalScope: { repoWrite: true },
       }),
     ).resolves.toMatchObject({
-      token: 'vso.build vso.code_manage vso.graph vso.project vso.profile',
+      token:
+        'vso.build vso.code vso.graph vso.project vso.profile vso.code_manage',
     });
 
     const bitbucketAuth = ScmAuth.forBitbucket(mockAuthApi);
@@ -135,7 +136,8 @@ describe('ScmAuth', () => {
         additionalScope: { repoWrite: true },
       }),
     ).resolves.toMatchObject({
-      token: 'account team pullrequest:write snippet:write issue:write',
+      token:
+        'account team pullrequest snippet issue pullrequest:write snippet:write issue:write',
     });
   });
 
diff --git a/packages/integration-react/src/api/ScmAuth.ts b/packages/integration-react/src/api/ScmAuth.ts
index 8065600640..54a85e94c7 100644
--- a/packages/integration-react/src/api/ScmAuth.ts
+++ b/packages/integration-react/src/api/ScmAuth.ts
@@ -22,7 +22,9 @@ import {
 } from './ScmAuthApi';
 
 type ScopeMapping = {
+  /** The base scopes used for all requests */
   default: string[];
+  /** Additional scopes added if `repoWrite` is requested */
   repoWrite: string[];
 };
 
@@ -91,7 +93,7 @@ export class ScmAuth implements ScmAuthApi {
     const host = options?.host ?? 'github.com';
     return new ScmAuth(githubAuthApi, host, {
       default: ['repo', 'read:org', 'read:user'],
-      repoWrite: ['repo', 'read:org', 'read:user', 'gist'],
+      repoWrite: ['gist'],
     });
   }
 
@@ -117,7 +119,7 @@ export class ScmAuth implements ScmAuthApi {
     const host = options?.host ?? 'gitlab.com';
     return new ScmAuth(gitlabAuthApi, host, {
       default: ['read_user', 'read_api', 'read_repository'],
-      repoWrite: ['read_user', 'read_api', 'write_repository', 'api'],
+      repoWrite: ['write_repository', 'api'],
     });
   }
 
@@ -149,13 +151,7 @@ export class ScmAuth implements ScmAuthApi {
         'vso.project',
         'vso.profile',
       ],
-      repoWrite: [
-        'vso.build',
-        'vso.code_manage',
-        'vso.graph',
-        'vso.project',
-        'vso.profile',
-      ],
+      repoWrite: ['vso.code_manage'],
     });
   }
 
@@ -181,13 +177,7 @@ export class ScmAuth implements ScmAuthApi {
     const host = options?.host ?? 'bitbucket.org';
     return new ScmAuth(bitbucketAuthApi, host, {
       default: ['account', 'team', 'pullrequest', 'snippet', 'issue'],
-      repoWrite: [
-        'account',
-        'team',
-        'pullrequest:write',
-        'snippet:write',
-        'issue:write',
-      ],
+      repoWrite: ['pullrequest:write', 'snippet:write', 'issue:write'],
     });
   }
 
@@ -220,9 +210,11 @@ export class ScmAuth implements ScmAuthApi {
     options: ScmAuthTokenOptions,
   ): Promise<ScmAuthTokenResponse> {
     const { url, additionalScope, ...restOptions } = options;
-    const scopes = additionalScope?.repoWrite
-      ? this.#scopeMapping.repoWrite
-      : this.#scopeMapping.default;
+
+    const scopes = this.#scopeMapping.default.slice();
+    if (additionalScope?.repoWrite) {
+      scopes.push(...this.#scopeMapping.repoWrite);
+    }
 
     const token = await this.#api.getAccessToken(scopes, restOptions);
     return {