diff --git a/.woodpecker/update-audit.yml b/.woodpecker/update-audit.yml
index f0297869..ce8a2d47 100644
--- a/.woodpecker/update-audit.yml
+++ b/.woodpecker/update-audit.yml
@@ -34,11 +34,15 @@ steps:
     environment:
       CLAUDE_CODE_OAUTH_TOKEN:
         from_secret: claude_code_oauth_token
-      # Reuses the security bot's Gitea token (needs issues:write on the
-      # repo). Swap to a dedicated token here if you want the audit issues
-      # attributed to a separate machine account.
+      # security_bot_token is scoped for code/PRs only — its issue POST
+      # returned HTTP 403 "token does not have ... write:issue", so the
+      # audit ran green but never created an issue. Switch to gitea_token,
+      # the broader machine account already used by build-caddy /
+      # build-ci-images for release + registry writes, which is the most
+      # likely existing secret to also carry write:issue. Audit issues are
+      # then attributed to this token's owner rather than the security bot.
       GITEA_TOKEN:
-        from_secret: security_bot_token
+        from_secret: gitea_token
     commands:
       - |
         # Hand off to Claude Code in headless mode. Same auth model as the