diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index ae151ff..3a09ea4 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -67,5 +67,5 @@ jobs:
       - name: Trigger Watchtower update
         if: success()
         run: |
-          curl -sf -H "Authorization: Bearer ${{ secrets.WATCHTOWER_TOKEN }}" \
+          curl -sf -H "Authorization: Bearer ${{ secrets.WATCHTOWER_HTTP_API_TOKEN }}" \
             http://watchtower:8080/v1/update
diff --git a/AGENTS.md b/AGENTS.md
index d577298..f37bbc7 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -93,7 +93,7 @@ make typecheck      # mypy
 - Deployment is CI-driven: pushing a `v*` tag makes Gitea Actions test, build, and push
   `desklock-gateway:{latest,tag}` to the registry and trigger Watchtower
   (`.gitea/workflows/build.yml`; needs `REGISTRY_USER`/`REGISTRY_PASSWORD`/
-  `WATCHTOWER_TOKEN` secrets). Plain pushes to `main` run lint + tests only. The
+  `WATCHTOWER_HTTP_API_TOKEN` secrets). Plain pushes to `main` run lint + tests only. The
   gateway deploys as part of the **`tatlock-ui` Portainer stack** —
   `system-admin-toj/containers/stacks/tatlock-ui.yml` (registered in `CONTAINERS.md`,
   port 8600). Stack updates go through the Portainer API on :8001 (JWT auth; recipe in
diff --git a/docs/architecture.md b/docs/architecture.md
index fd1e527..bd16b03 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -257,7 +257,7 @@ Gitea Actions (`.gitea/workflows/build.yml`), following the tatlock/tatlock-ui p
   Gitea registry, create a release, and trigger Watchtower to roll the running
   container.
 - Required repo/org secrets: `REGISTRY_USER`, `REGISTRY_PASSWORD`,
-  `WATCHTOWER_TOKEN` (same trio tatlock uses).
+  `WATCHTOWER_HTTP_API_TOKEN` (same trio tatlock uses).
 - The gateway is a service in the **`tatlock-ui` Portainer stack**
   (`system-admin-toj/containers/stacks/tatlock-ui.yml`, registered in
   `CONTAINERS.md`): it shares `docker-dataplane` with Speaches (service-name URL