diff --git a/.github/workflows/sync-blog-articles.yml b/.github/workflows/sync-blog-articles.yml
index 894edc001..03a9d3ca1 100644
--- a/.github/workflows/sync-blog-articles.yml
+++ b/.github/workflows/sync-blog-articles.yml
@@ -27,7 +27,7 @@ jobs:
           ref: master
           fetch-depth: 0
           # A PAT push triggers the mirror and Wiki workflows; GITHUB_TOKEN does not.
-          token: ${{ secrets.LANGBOT_WIKI_PUSH_TOKEN }}
+          token: ${{ secrets.LANGBOT_WIKI_PUSH_TOKEN || secrets.RELEASE_UPLOAD_GITHUB_TOKEN }}
       - uses: actions/setup-node@v7
         with:
           node-version: '24'
@@ -38,7 +38,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           repository: langbot-app/langbot-landing-page
-          token: ${{ secrets.LANGBOT_WIKI_PUSH_TOKEN }}
+          token: ${{ secrets.LANGBOT_WIKI_PUSH_TOKEN || secrets.RELEASE_UPLOAD_GITHUB_TOKEN }}
           path: .article-source
           persist-credentials: false
       - name: Synchronize articles and images
diff --git a/.github/workflows/sync-github-wiki.yml b/.github/workflows/sync-github-wiki.yml
index 0aa788127..eed97553f 100644
--- a/.github/workflows/sync-github-wiki.yml
+++ b/.github/workflows/sync-github-wiki.yml
@@ -68,7 +68,7 @@ jobs:
           path: generated
       - name: Clone target Wiki
         env:
-          WIKI_PUSH_TOKEN: ${{ secrets.LANGBOT_WIKI_PUSH_TOKEN }}
+          WIKI_PUSH_TOKEN: ${{ secrets.LANGBOT_WIKI_PUSH_TOKEN || secrets.RELEASE_UPLOAD_GITHUB_TOKEN }}
         run: |
           test -n "$WIKI_PUSH_TOKEN"
           git clone "https://x-access-token:${WIKI_PUSH_TOKEN}@github.com/langbot-app/LangBot.wiki.git" target
diff --git a/.github/workflows/sync-landing-submodule.yml b/.github/workflows/sync-landing-submodule.yml
index daa93bce7..b6d99468a 100644
--- a/.github/workflows/sync-landing-submodule.yml
+++ b/.github/workflows/sync-landing-submodule.yml
@@ -29,7 +29,7 @@ jobs:
         run: python3 -m unittest discover -s tests -p test_sync_landing_submodule.py -v
       - name: Publish docs subtree (fast-forward only)
         env:
-          GH_TOKEN: ${{ secrets.LANGBOT_WIKI_PUSH_TOKEN }}
+          GH_TOKEN: ${{ secrets.LANGBOT_WIKI_PUSH_TOKEN || secrets.RELEASE_UPLOAD_GITHUB_TOKEN }}
         run: |
           gh auth setup-git
           git remote add docs-mirror https://github.com/langbot-app/langbot-docs.git
@@ -40,5 +40,5 @@ jobs:
       - name: Update landing submodule and production fork
         working-directory: docs
         env:
-          GH_TOKEN: ${{ secrets.LANGBOT_WIKI_PUSH_TOKEN }}
+          GH_TOKEN: ${{ secrets.LANGBOT_WIKI_PUSH_TOKEN || secrets.RELEASE_UPLOAD_GITHUB_TOKEN }}
         run: python3 scripts/sync-landing-submodule.py
diff --git a/dev-docs/DOCS_MIGRATION.md b/dev-docs/DOCS_MIGRATION.md
index 3b032fc2e..7f69df28f 100644
--- a/dev-docs/DOCS_MIGRATION.md
+++ b/dev-docs/DOCS_MIGRATION.md
@@ -29,19 +29,24 @@ canonical URL `https://langbot.app/docs`.
    `git subtree pull --prefix=docs <mirror-url> main` through another reviewed PR
    before cutover; reapply the inert mirror workflow files if necessary. Never
    force-push or rewrite the mirror history.
-3. Verify `LANGBOT_WIKI_PUSH_TOKEN` is configured in LangBot with existing access
-   to the docs mirror, LangBot Wiki, landing upstream and production fork. The
-   blog job additionally needs to push to LangBot main and trigger workflows.
-   Repository workflow-file updates must be permitted by that token. Do not
-   weaken branch protection to accommodate this migration; use a separately
-   reviewed publication approach if the current token cannot perform the push.
+3. The publication jobs read `LANGBOT_WIKI_PUSH_TOKEN` and fall back to the
+   existing `RELEASE_UPLOAD_GITHUB_TOKEN` when that secret is absent. The fallback
+   was verified on a scratch branch: it authenticates as the repository owner
+   with `repo` scope and push+admin on `LangBot`, `langbot-docs`,
+   `langbot-landing-page` and the production fork, and it can clone and push the
+   Wiki. It does not carry the `workflow` scope, so it cannot push changes to
+   `.github/workflows/**` in the mirror; the split only rewrites `docs/**`
+   content, so this is fine unless a future change edits the inert mirror stubs.
+   Adding a dedicated `LANGBOT_WIKI_PUSH_TOKEN` with the same access keeps the
+   blast radius of the fallback credential out of the docs pipeline. Do not
+   weaken branch protection to accommodate this migration.
 4. Set LangBot repository variable `DOCS_MIRROR_ENABLED=true`. Dispatch
-   `sync-landing-submodule.yml` on main. It fetches full main history, runs
+   `sync-landing-submodule.yml` on master. It fetches full master history, runs
    `git subtree split --prefix=docs`, verifies the current mirror head is an
    ancestor, pushes without force, then advances only landing's `docs` gitlink.
    The first split replaces legacy mirror workflows with inert manual stubs.
 5. Dispatch `sync-github-wiki.yml` and `sync-blog-articles.yml` in LangBot.
-   The blog job now commits only docs article paths to LangBot main using the
+   The blog job now commits only docs article paths to LangBot master using the
    dedicated token, so its push triggers the mirror and Wiki workflows.
 6. Confirm the `docs` gitlink in `langbot-app/langbot-landing-page`, then confirm
    production fork `RockChinQ/LangBot-LandingPage-Vue` matches upstream. This is