diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3b04d7b..3ff4df8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,3 +21,5 @@ jobs:
       - run: npm ci
 
       - run: npm run cf:build
+        env:
+          SYNC_DOCS_TOKEN: ${{ secrets.SYNC_DOCS_TOKEN }}
diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml
index 4dea37c..99bc9cd 100644
--- a/.github/workflows/preview.yml
+++ b/.github/workflows/preview.yml
@@ -24,6 +24,8 @@ jobs:
       - run: npm ci
 
       - run: npm run cf:build
+        env:
+          SYNC_DOCS_TOKEN: ${{ secrets.SYNC_DOCS_TOKEN }}
 
       - name: Deploy preview
         id: deploy
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5fd5da2..2b10351 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -36,6 +36,8 @@ jobs:
       - run: npm ci
 
       - run: npm run cf:build
+        env:
+          SYNC_DOCS_TOKEN: ${{ secrets.SYNC_DOCS_TOKEN }}
 
       - run: npm run cf:deploy
         env:
diff --git a/scripts/sync-docs.js b/scripts/sync-docs.js
index 8f13b4f..425e2ea 100644
--- a/scripts/sync-docs.js
+++ b/scripts/sync-docs.js
@@ -19,9 +19,9 @@
 //                    instead of cloning (no GitHub token required). Falls
 //                    through to clone if a local copy is missing.
 //
-// Auth note: cloning private repos on Cloudflare Pages requires GITHUB_TOKEN
-// to be set in the Pages environment to a fine-grained PAT with read access
-// to the relevant repos.
+// Auth note: cloning private repos requires SYNC_DOCS_TOKEN to be set to a
+// fine-grained PAT with read access to the relevant repos. In CI it's
+// passed in from the SYNC_DOCS_TOKEN repo secret.
 
 import { existsSync, mkdirSync, rmSync, cpSync, writeFileSync } from "fs";
 import { execSync } from "child_process";
@@ -35,13 +35,12 @@ const tmpDir = join(root, ".sync-docs-tmp");
 // Edit this list as new product docs come online. `docsPath` is the path
 // inside each product repo where publishable docs live (relative to repo
 // root). Default is "docs/site" — keeps repo /docs/ free for internal
-// planning. wavekat-voice (when re-enabled) uses "docs" since it predates
-// the convention.
+// planning.
 const sources = [
-  { slug: "cli",  repo: "wavekat/wavekat-cli",  docsPath: "docs/site", private: false },
+  { slug: "cli",   repo: "wavekat/wavekat-cli",   docsPath: "docs/site", private: false },
+  { slug: "voice", repo: "wavekat/wavekat-voice", docsPath: "docs/site", private: true  },
   // { slug: "vad",   repo: "wavekat/wavekat-vad",   docsPath: "docs/site", private: false },
   // { slug: "turn",  repo: "wavekat/wavekat-turn",  docsPath: "docs/site", private: false },
-  // { slug: "voice", repo: "wavekat/wavekat-voice", docsPath: "docs",      private: true  },
   // { slug: "lab",   repo: "wavekat/wavekat-lab",   docsPath: "docs/site", private: false },
   // { slug: "core",  repo: "wavekat/wavekat-core",  docsPath: "docs/site", private: false },
   // { slug: "tts",   repo: "wavekat/wavekat-tts",   docsPath: "docs/site", private: false },
@@ -53,12 +52,12 @@ const enabled = process.env.SYNC_DOCS === "1";
 const localBase = process.env.WAVEKAT_LOCAL_REPOS;
 
 function repoUrl({ repo, private: isPrivate }) {
-  const token = process.env.GITHUB_TOKEN;
+  const token = process.env.SYNC_DOCS_TOKEN;
   if (isPrivate) {
     if (!token) {
       throw new Error(
-        `GITHUB_TOKEN required to clone private repo ${repo}. ` +
-          `Set it in the Cloudflare Pages environment (fine-grained PAT, read access).`
+        `SYNC_DOCS_TOKEN required to clone private repo ${repo}. ` +
+          `Set it to a fine-grained PAT with read access to the repo.`
       );
     }
     return `https://x-access-token:${token}@github.com/${repo}.git`;