diff --git a/.github/scripts/update-spam-list.js b/.github/scripts/update-spam-list.js
index f9cc4ed28..33c99b32a 100644
--- a/.github/scripts/update-spam-list.js
+++ b/.github/scripts/update-spam-list.js
@@ -8,7 +8,6 @@
  */
 
 const fs = require('fs').promises;
-const path = require('path');
 
 const SPAM_LIST_PATH = '.github/spam-list.txt';
 const dryRun = (process.env.DRY_RUN || 'false').toString().toLowerCase() === 'true';
@@ -72,31 +71,12 @@ async function computeSpamListUpdates(spamUsers, rehabilitatedUsers) {
   };
 }
 
-// Write the updated spam list to file
-async function updateSpamListFile(usernames) {
-  if (dryRun) {
-    console.log('[DRY RUN] Would write to spam list file:');
-    console.log(usernames.join('\n'));
-    return;
-  }
-  
-  const content = usernames.join('\n') + (usernames.length > 0 ? '\n' : '');
-  
-  // Ensure directory exists
-  const dir = path.dirname(SPAM_LIST_PATH);
-  await fs.mkdir(dir, { recursive: true });
-  
-  await fs.writeFile(SPAM_LIST_PATH, content, 'utf8');
-
-}
-
-// Generate PR title and body with summary of changes
 
 function generateSummary(additions, removals) {
-  const title = `chore: Update spam list (${additions.length} additions, ${removals.length} removals)`;
+  const title = `Update spam list (${additions.length} additions, ${removals.length} removals)`;
   
   let body = '## Automated Spam List Update\n\n';
-  body += 'This PR automatically updates the spam list based on recent PR activity.\n\n';
+  body += 'This issue details the updates to the spam list based on recent PR activity.\n\n';
   
   if (additions.length > 0) {
     body += `### ➕ Additions (${additions.length})\n\n`;
@@ -206,8 +186,8 @@ module.exports = async ({github, context, core}) => {
       }
     }
 
-    // ... rest remains the same
-    const { additions, removals, finalSpamList } = await computeSpamListUpdates(
+    // After processing all PRs, compute the final spam list updates
+    const { additions, removals } = await computeSpamListUpdates(
       spamUsers,
       rehabilitatedUsers
     );
@@ -215,28 +195,40 @@ module.exports = async ({github, context, core}) => {
     console.log(`Additions: ${additions.length}`);
     console.log(`Removals: ${removals.length}`);
     
-    if (additions.length > 0 || removals.length > 0) {
-      await updateSpamListFile(finalSpamList);
-    }
-    
     const { title, body } = generateSummary(additions, removals);
     const hasChanges = additions.length > 0 || removals.length > 0;
     
-    const branchName = hasChanges 
-      ? `spam-list-update-${new Date().toISOString().split('T')[0]}`
-      : '';
-    
-    core.setOutput('has-changes', hasChanges.toString());
-    core.setOutput('pr-title', title);
-    core.setOutput('pr-body', body);
-    core.setOutput('branch-name', branchName);
+    if (hasChanges) {
+      if (dryRun) {
+        console.log('[DRY RUN] Would create issue with:');
+        console.log(`Title: ${title}`);
+        console.log(`Body: ${body}`);
+      } else {
+        // Check for existing open issue to avoid duplicates
+        const { data: existing } = await github.rest.issues.listForRepo({
+          owner,
+          repo,
+          labels: 'spam-list-update',
+          state: 'open',
+          per_page: 1
+        });
+        if (existing.length > 0) {
+          console.log(`Skipping issue creation: open issue #${existing[0].number} already exists`);
+          return;
+        }
+        await github.rest.issues.create({
+          owner,
+          repo,
+          title,
+          body,
+          labels: ['spam-list-update', 'automated']
+        });
+        console.log('Issue created successfully');
+      }
+    } else {
+      console.log('No changes needed, skipping issue creation');
+    }
     
-    return {
-      hasChanges,
-      title,
-      body,
-      branchName
-    };
   } catch (error) {
     core.setFailed(`Failed to update spam list: ${error.message}`);
     throw error;
diff --git a/.github/workflows/cron-update-spam-list.yml b/.github/workflows/cron-update-spam-list.yml
index e51910a77..cc4f6fbb7 100644
--- a/.github/workflows/cron-update-spam-list.yml
+++ b/.github/workflows/cron-update-spam-list.yml
@@ -11,8 +11,9 @@ on:
         default: 'true'
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
+  pull-requests: read
+  issues: write
 
 env:
   DRY_RUN: ${{ github.event.inputs.dry_run || 'false' }}
@@ -22,12 +23,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden runner (audit outbound calls)
-        uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
+        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
         with:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Update spam list
         id: update-spam-list
@@ -37,17 +38,3 @@ jobs:
           script: |
             const updateSpamList = require('./.github/scripts/update-spam-list.js');
             await updateSpamList({ github, context, core });
-            
-
-      - name: Create pull request
-        if: ${{ steps.update-spam-list.outputs.has-changes == 'true' && env.DRY_RUN != 'true' }}
-        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          commit-message: ${{ steps.update-spam-list.outputs.pr-title }}
-          branch: ${{ steps.update-spam-list.outputs.branch-name }}
-          title: ${{ steps.update-spam-list.outputs.pr-title }}
-          body: ${{ steps.update-spam-list.outputs.pr-body }}
-          labels: automated, spam-management
-          add-paths: |
-            .github/spam-list.txt
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3b56c8dad..317fd6f96 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -290,6 +290,7 @@ This changelog is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.
 - Fixed incorrect run instructions and broaden error handling in `token_dissociate_transaction.py` example to improve usability for new users (#1468)
 - Update `.github/scripts/bot-advanced-check.sh` to unassign unqualified users.
 - Fixed broken project structure link in `CONTRIBUTING.md` (#1664)
+- Refactor spam list update logic and remove unused pull request creation step `.github/scripts/update-spam-list.js` `.github/workflows/cron-update-spam-list.yml`.
 
 ### Removed