diff --git a/pkg/github/issues.go b/pkg/github/issues.go
index dfb823e26b..1c27e15d82 100644
--- a/pkg/github/issues.go
+++ b/pkg/github/issues.go
@@ -946,6 +946,15 @@ func GetSubIssues(ctx context.Context, client *github.Client, deps ToolDependenc
 		subIssues = filteredSubIssues
 	}
 
+	for _, subIssue := range subIssues {
+		if subIssue.Title != nil {
+			subIssue.Title = github.Ptr(sanitize.Sanitize(*subIssue.Title))
+		}
+		if subIssue.Body != nil {
+			subIssue.Body = github.Ptr(sanitize.Sanitize(*subIssue.Body))
+		}
+	}
+
 	r, err := json.Marshal(subIssues)
 	if err != nil {
 		return nil, fmt.Errorf("failed to marshal response: %w", err)
diff --git a/pkg/github/minimal_types.go b/pkg/github/minimal_types.go
index e2bf8b684b..127e2e4b25 100644
--- a/pkg/github/minimal_types.go
+++ b/pkg/github/minimal_types.go
@@ -820,8 +820,10 @@ func convertToMinimalIssuesResponse(fragment IssueQueryFragment) MinimalIssuesRe
 
 func convertToMinimalIssueComment(comment *github.IssueComment) MinimalIssueComment {
 	m := MinimalIssueComment{
-		ID:                comment.GetID(),
-		Body:              comment.GetBody(),
+		ID: comment.GetID(),
+		// Bodies carry the same invisible-glyph / HTML injection surface as
+		// issue and PR bodies, which the read paths already sanitize.
+		Body:              sanitize.Sanitize(comment.GetBody()),
 		HTMLURL:           comment.GetHTMLURL(),
 		User:              convertToMinimalUser(comment.GetUser()),
 		AuthorAssociation: comment.GetAuthorAssociation(),