diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
index e90a2bf..6f11ddb 100644
--- a/.github/workflows/ci-cd.yml
+++ b/.github/workflows/ci-cd.yml
@@ -78,9 +78,9 @@ jobs:
       # Gateway-API cluster kubeconfig (V2)
       kubeconfig-gateway: ${{ secrets.S9DEV_KUBECONFIG_V2 }}
 
-      # Custom PAT used for git tagging only (the GHCR chart push/pull use the
-      # built-in GITHUB_TOKEN, so this PAT does not need write:packages).
-      github-token: ${{ secrets.S9_GITHUB_TOKEN }}
+      # Tagging uses the job's built-in GITHUB_TOKEN (contents: write is granted
+      # above). The org PAT used here before expired (HTTP 401).
+      github-token: ${{ secrets.GITHUB_TOKEN }}
 
       # App configuration passed to helm --set-string during deploy (masked)
       helm-set-secret-values: 'db=${{ secrets.DBCS }}'