diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index a68e7cc..2a597ad 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -37,5 +37,5 @@ jobs:
       - name: Deploy non-production Worker
         run: npx wrangler deploy --config "wrangler/${SITE_KEY}.jsonc"
         env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_WORKER_PREVIEW_TOKEN }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
diff --git a/README.md b/README.md
index 1787920..ac8c2a6 100644
--- a/README.md
+++ b/README.md
@@ -35,7 +35,7 @@ routes, account IDs, or secrets.
 
 The Gitea workflow deploys only a non-production Worker from the pilot branch:
 `3031023-xyz-www-preview` by default, or the manually selected `blog` site.
-It uses repository secrets `CF_WORKER_PREVIEW_TOKEN` and `CF_ACCOUNT_ID`.
+It uses the existing repository secrets `CF_API_TOKEN` and `CF_ACCOUNT_ID`.
 Routine jobs do not configure DNS or custom domains.
 
 Production hostname attachment and the `www` redirect are manual,