diff --git a/templates/workflows/dolibarr/auto-release.yml.template b/templates/workflows/dolibarr/auto-release.yml.template
index 4fe0edf..1ba8971 100644
--- a/templates/workflows/dolibarr/auto-release.yml.template
+++ b/templates/workflows/dolibarr/auto-release.yml.template
@@ -60,13 +60,13 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
-          token: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          token: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           fetch-depth: 0
 
       - name: Setup MokoStandards tools
         env:
-          GH_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
-          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
+          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           MOKO_CLONE_HOST: ${{ secrets.GA_TOKEN && 'git.mokoconsulting.tech/MokoConsulting' || 'github.com/mokoconsulting-tech' }}
           COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_TOKEN || github.token }}"}}'
         run: |
@@ -313,7 +313,7 @@ jobs:
           steps.version.outputs.skip != 'true' &&
           steps.check.outputs.tag_exists != 'true'
         env:
-          GH_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
         run: |
           VERSION="${{ steps.version.outputs.version }}"
           RELEASE_TAG="${{ steps.version.outputs.release_tag }}"
diff --git a/templates/workflows/dolibarr/ci-dolibarr.yml.template b/templates/workflows/dolibarr/ci-dolibarr.yml.template
index 926e6df..edf752f 100644
--- a/templates/workflows/dolibarr/ci-dolibarr.yml.template
+++ b/templates/workflows/dolibarr/ci-dolibarr.yml.template
@@ -48,8 +48,8 @@ jobs:
 
       - name: Clone MokoStandards
         env:
-          GH_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
-          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
+          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           MOKO_CLONE_HOST: ${{ secrets.GA_TOKEN && 'git.mokoconsulting.tech/MokoConsulting' || 'github.com/mokoconsulting-tech' }}
         run: |
           git clone --depth 1 --branch {{standards_branch}} --quiet \
diff --git a/templates/workflows/dolibarr/publish-to-mokodolimods.yml.template b/templates/workflows/dolibarr/publish-to-mokodolimods.yml.template
index 8ba13e7..d5e79d0 100644
--- a/templates/workflows/dolibarr/publish-to-mokodolimods.yml.template
+++ b/templates/workflows/dolibarr/publish-to-mokodolimods.yml.template
@@ -149,7 +149,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           repository: mokoconsulting-tech/mokodolimods
-          token: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          token: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           path: mokodolimods
 
       - name: Create release branch
@@ -207,7 +207,7 @@ jobs:
       - name: Create pull request on mokodolimods
         if: steps.commit.outputs.changed == 'true'
         env:
-          GH_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
         run: |
           MODULE="${{ steps.branch.outputs.module }}"
           TAG="${{ steps.branch.outputs.tag }}"
diff --git a/templates/workflows/dolibarr/repo_health.yml.template b/templates/workflows/dolibarr/repo_health.yml.template
index 2d118e1..a5cb589 100644
--- a/templates/workflows/dolibarr/repo_health.yml.template
+++ b/templates/workflows/dolibarr/repo_health.yml.template
@@ -88,7 +88,7 @@ jobs:
       - name: Check actor permission (admin only)
         id: perm
         env:
-          TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           REPO: ${{ github.repository }}
           ACTOR: ${{ github.actor }}
         run: |
diff --git a/templates/workflows/health-check.yml b/templates/workflows/health-check.yml
index e07b770..6324828 100644
--- a/templates/workflows/health-check.yml
+++ b/templates/workflows/health-check.yml
@@ -252,7 +252,7 @@ jobs:
       - name: Create or update health issue
         if: always()
         env:
-          GH_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
         run: |
           REPO="${{ github.repository }}"
           RUN_URL="${{ github.server_url }}/${REPO}/actions/runs/${{ github.run_id }}"
diff --git a/templates/workflows/joomla/auto-release.yml.template b/templates/workflows/joomla/auto-release.yml.template
index 252ad8b..0bc9157 100644
--- a/templates/workflows/joomla/auto-release.yml.template
+++ b/templates/workflows/joomla/auto-release.yml.template
@@ -66,12 +66,12 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.GA_TOKEN }}
           fetch-depth: 0
 
       - name: Setup MokoStandards tools
         env:
-          MOKO_CLONE_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN }}
           MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
           COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_MIRROR_TOKEN }}"}}'
         run: |
@@ -432,13 +432,13 @@ jobs:
           [ -z "$NOTES" ] && NOTES="Release ${VERSION}"
 
           # Check if the major release already exists
-          EXISTING=$(curl -sf -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+          EXISTING=$(curl -sf -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
             "${API_BASE}/releases/tags/${RELEASE_TAG}" 2>/dev/null || true)
           EXISTING_ID=$(echo "$EXISTING" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('id',''))" 2>/dev/null || true)
 
           if [ -z "$EXISTING_ID" ]; then
             # First release for this major
-            curl -sf -X POST -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+            curl -sf -X POST -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
               -H "Content-Type: application/json" \
               "${API_BASE}/releases" \
               -d "$(python3 -c "import json; print(json.dumps({
@@ -458,7 +458,7 @@ jobs:
 
           ${NOTES}"
 
-            curl -sf -X PATCH -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+            curl -sf -X PATCH -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
               -H "Content-Type: application/json" \
               "${API_BASE}/releases/${EXISTING_ID}" \
               -d "$(python3 -c "import json,sys; print(json.dumps({
@@ -479,7 +479,7 @@ jobs:
           API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
 
           # All ZIPs upload to the major release tag (vXX)
-          RELEASE_JSON=$(curl -sf -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+          RELEASE_JSON=$(curl -sf -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
             "${API_BASE}/releases/tags/${RELEASE_TAG}" 2>/dev/null || true)
           RELEASE_ID=$(echo "$RELEASE_JSON" | python3 -c "import sys,json; print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)
           if [ -z "$RELEASE_ID" ]; then
@@ -520,7 +520,7 @@ jobs:
           SHA256_TAR=$(sha256sum "/tmp/${TAR_NAME}" | cut -d' ' -f1)
 
           # -- Delete existing assets with same name before uploading ------
-          ASSETS=$(curl -sf -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+          ASSETS=$(curl -sf -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
             "${API_BASE}/releases/${RELEASE_ID}/assets" 2>/dev/null || echo "[]")
           for ASSET_NAME in "$ZIP_NAME" "$TAR_NAME"; do
             ASSET_ID=$(echo "$ASSETS" | python3 -c "
@@ -531,18 +531,18 @@ jobs:
                   print(a['id']); break
           " 2>/dev/null || true)
             if [ -n "$ASSET_ID" ]; then
-              curl -sf -X DELETE -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+              curl -sf -X DELETE -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
                 "${API_BASE}/releases/${RELEASE_ID}/assets/${ASSET_ID}" 2>/dev/null || true
             fi
           done
 
           # -- Upload both to release tag ----------------------------------
-          curl -sf -X POST -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+          curl -sf -X POST -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
             -H "Content-Type: application/octet-stream" \
             --data-binary @"/tmp/${ZIP_NAME}" \
             "${API_BASE}/releases/${RELEASE_ID}/assets?name=${ZIP_NAME}" > /dev/null 2>&1 || true
 
-          curl -sf -X POST -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+          curl -sf -X POST -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
             -H "Content-Type: application/octet-stream" \
             --data-binary @"/tmp/${TAR_NAME}" \
             "${API_BASE}/releases/${RELEASE_ID}/assets?name=${TAR_NAME}" > /dev/null 2>&1 || true
diff --git a/templates/workflows/joomla/ci-joomla.yml.template b/templates/workflows/joomla/ci-joomla.yml.template
index 348cdde..4474a62 100644
--- a/templates/workflows/joomla/ci-joomla.yml.template
+++ b/templates/workflows/joomla/ci-joomla.yml.template
@@ -48,8 +48,8 @@ jobs:
 
       - name: Clone MokoStandards
         env:
-          GH_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
-          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
+          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           MOKO_CLONE_HOST: ${{ secrets.GA_TOKEN && 'git.mokoconsulting.tech/MokoConsulting' || 'github.com/mokoconsulting-tech' }}
         run: |
           git clone --depth 1 --branch {{standards_branch}} --quiet \
diff --git a/templates/workflows/joomla/deploy-manual.yml.template b/templates/workflows/joomla/deploy-manual.yml.template
index a57be26..a5fa9ae 100644
--- a/templates/workflows/joomla/deploy-manual.yml.template
+++ b/templates/workflows/joomla/deploy-manual.yml.template
@@ -48,8 +48,8 @@ jobs:
 
       - name: Setup MokoStandards tools
         env:
-          GH_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
-          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
+          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           MOKO_CLONE_HOST: ${{ secrets.GA_TOKEN && 'git.mokoconsulting.tech/MokoConsulting' || 'github.com/mokoconsulting-tech' }}
           COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_TOKEN || github.token }}"}}'
         run: |
diff --git a/templates/workflows/joomla/repo_health.yml.template b/templates/workflows/joomla/repo_health.yml.template
index 13e46ad..80f1bc5 100644
--- a/templates/workflows/joomla/repo_health.yml.template
+++ b/templates/workflows/joomla/repo_health.yml.template
@@ -88,7 +88,7 @@ jobs:
       - name: Check actor permission (admin only)
         id: perm
         env:
-          TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           REPO: ${{ github.repository }}
           ACTOR: ${{ github.actor }}
         run: |
diff --git a/templates/workflows/joomla/update-server.yml.template b/templates/workflows/joomla/update-server.yml.template
index 4a9d62c..c71c507 100644
--- a/templates/workflows/joomla/update-server.yml.template
+++ b/templates/workflows/joomla/update-server.yml.template
@@ -64,12 +64,12 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.GA_TOKEN }}
           fetch-depth: 0
 
       - name: Setup MokoStandards tools
         env:
-          MOKO_CLONE_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN }}
           MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
           COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_MIRROR_TOKEN }}"}}'
         run: |
@@ -201,13 +201,13 @@ jobs:
             SHA256=$(sha256sum "/tmp/${PACKAGE_NAME}" | cut -d' ' -f1)
 
             # Ensure release exists on Gitea
-            RELEASE_JSON=$(curl -sf -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+            RELEASE_JSON=$(curl -sf -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
               "${API_BASE}/releases/tags/${RELEASE_TAG}" 2>/dev/null || true)
             RELEASE_ID=$(echo "$RELEASE_JSON" | python3 -c "import sys,json; print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)
 
             if [ -z "$RELEASE_ID" ]; then
               # Create release
-              RELEASE_JSON=$(curl -sf -X POST -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+              RELEASE_JSON=$(curl -sf -X POST -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
                 -H "Content-Type: application/json" \
                 "${API_BASE}/releases" \
                 -d "$(python3 -c "import json; print(json.dumps({
@@ -222,7 +222,7 @@ jobs:
 
             if [ -n "$RELEASE_ID" ]; then
               # Delete existing assets with same name before uploading
-              ASSETS=$(curl -sf -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+              ASSETS=$(curl -sf -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
                 "${API_BASE}/releases/${RELEASE_ID}/assets" 2>/dev/null || echo "[]")
               for ASSET_FILE in "$PACKAGE_NAME" "$TAR_NAME"; do
                 ASSET_ID=$(echo "$ASSETS" | python3 -c "
@@ -233,18 +233,18 @@ jobs:
                   print(a['id']); break
           " 2>/dev/null || true)
                 if [ -n "$ASSET_ID" ]; then
-                  curl -sf -X DELETE -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+                  curl -sf -X DELETE -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
                     "${API_BASE}/releases/${RELEASE_ID}/assets/${ASSET_ID}" 2>/dev/null || true
                 fi
               done
 
               # Upload both formats
-              curl -sf -X POST -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+              curl -sf -X POST -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
                 -H "Content-Type: application/octet-stream" \
                 --data-binary @"/tmp/${PACKAGE_NAME}" \
                 "${API_BASE}/releases/${RELEASE_ID}/assets?name=${PACKAGE_NAME}" > /dev/null 2>&1 || true
 
-              curl -sf -X POST -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+              curl -sf -X POST -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
                 -H "Content-Type: application/octet-stream" \
                 --data-binary @"/tmp/${TAR_NAME}" \
                 "${API_BASE}/releases/${RELEASE_ID}/assets?name=${TAR_NAME}" > /dev/null 2>&1 || true
@@ -367,7 +367,7 @@ jobs:
           REPO="${{ github.repository }}"
           API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
 
-          PERMISSION=$(curl -sf -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+          PERMISSION=$(curl -sf -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
             "${API_BASE}/collaborators/${ACTOR}/permission" 2>/dev/null | \
             python3 -c "import sys,json; print(json.load(sys.stdin).get('permission','read'))" 2>/dev/null || echo "read")
           case "$PERMISSION" in
diff --git a/templates/workflows/shared/auto-assign.yml.template b/templates/workflows/shared/auto-assign.yml.template
index 64ac3df..a648b39 100644
--- a/templates/workflows/shared/auto-assign.yml.template
+++ b/templates/workflows/shared/auto-assign.yml.template
@@ -32,7 +32,7 @@ jobs:
     steps:
       - name: Assign unassigned issues
         env:
-          GH_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
         run: |
           REPO="${{ github.repository }}"
           ASSIGNEE="jmiller-moko"
@@ -44,12 +44,12 @@ jobs:
           ASSIGNED_PRS=0
 
           # Assign unassigned open issues
-          ISSUES=$(gh api "repos/$REPO/issues?state=open&per_page=100&assignee=none" --jq '.[].number' 2>/dev/null || true)
+          ISSUES=$(curl -sf -H "Authorization: token ${{ secrets.GA_TOKEN }}" "${GITEA_URL:-https://git.mokoconsulting.tech}/api/v1/repos/${{ github.repository }}/issues?state=open&per_page=100&assignee=none" --jq '.[].number' 2>/dev/null || true)
           for NUM in $ISSUES; do
             # Skip PRs (the issues endpoint returns PRs too)
-            IS_PR=$(gh api "repos/$REPO/issues/$NUM" --jq '.pull_request // empty' 2>/dev/null || true)
+            IS_PR=$(curl -sf -H "Authorization: token ${{ secrets.GA_TOKEN }}" "${GITEA_URL:-https://git.mokoconsulting.tech}/api/v1/repos/${{ github.repository }}/issues/$NUM" --jq '.pull_request // empty' 2>/dev/null || true)
             if [ -z "$IS_PR" ]; then
-              gh api "repos/$REPO/issues/$NUM/assignees" -X POST -f "assignees[]=$ASSIGNEE" --silent 2>/dev/null && {
+              curl -sf -H "Authorization: token ${{ secrets.GA_TOKEN }}" "${GITEA_URL:-https://git.mokoconsulting.tech}/api/v1/repos/${{ github.repository }}/issues/$NUM/assignees" -X POST -f "assignees[]=$ASSIGNEE" --silent 2>/dev/null && {
                 ASSIGNED_ISSUES=$((ASSIGNED_ISSUES + 1))
                 echo "  Assigned issue #$NUM"
               } || true
@@ -57,9 +57,9 @@ jobs:
           done
 
           # Assign unassigned open PRs
-          PRS=$(gh api "repos/$REPO/pulls?state=open&per_page=100" --jq '.[] | select(.assignees | length == 0) | .number' 2>/dev/null || true)
+          PRS=$(curl -sf -H "Authorization: token ${{ secrets.GA_TOKEN }}" "${GITEA_URL:-https://git.mokoconsulting.tech}/api/v1/repos/${{ github.repository }}/pulls?state=open&per_page=100" --jq '.[] | select(.assignees | length == 0) | .number' 2>/dev/null || true)
           for NUM in $PRS; do
-            gh api "repos/$REPO/issues/$NUM/assignees" -X POST -f "assignees[]=$ASSIGNEE" --silent 2>/dev/null && {
+            curl -sf -H "Authorization: token ${{ secrets.GA_TOKEN }}" "${GITEA_URL:-https://git.mokoconsulting.tech}/api/v1/repos/${{ github.repository }}/issues/$NUM/assignees" -X POST -f "assignees[]=$ASSIGNEE" --silent 2>/dev/null && {
               ASSIGNED_PRS=$((ASSIGNED_PRS + 1))
               echo "  Assigned PR #$NUM"
             } || true
diff --git a/templates/workflows/shared/auto-dev-issue.yml.template b/templates/workflows/shared/auto-dev-issue.yml.template
index 70bb4d8..5670262 100644
--- a/templates/workflows/shared/auto-dev-issue.yml.template
+++ b/templates/workflows/shared/auto-dev-issue.yml.template
@@ -47,7 +47,7 @@ jobs:
     steps:
       - name: Create tracking issue and sub-issues
         env:
-          GH_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
         run: |
           # For manual dispatch, use input; for auto, use event ref
           if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
@@ -166,7 +166,7 @@ jobs:
               SUB_NUM=$(gh api "repos/${REPO}/issues?state=open&per_page=20" \
                 --jq ".[] | select(.title == \"${SUB_FULL_TITLE}\") | .number" 2>/dev/null | head -1)
               if [ -n "$SUB_NUM" ]; then
-                gh api "repos/${REPO}/issues/${SUB_NUM}" -X PATCH \
+                curl -sf -X PATCH -H "Authorization: token ${{ secrets.GA_TOKEN }}" "${GITEA_URL:-https://git.mokoconsulting.tech}/api/v1/repos/${{ github.repository }}/issues/${SUB_NUM}" \
                   -f body="$(gh api "repos/${REPO}/issues/${SUB_NUM}" --jq '.body' 2>/dev/null)
 
           > **Parent Issue:** #${PARENT_NUM}" --silent 2>/dev/null || true
diff --git a/templates/workflows/shared/auto-release.yml.template b/templates/workflows/shared/auto-release.yml.template
index 80357bb..62dabce 100644
--- a/templates/workflows/shared/auto-release.yml.template
+++ b/templates/workflows/shared/auto-release.yml.template
@@ -59,13 +59,13 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
-          token: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          token: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           fetch-depth: 0
 
       - name: Setup MokoStandards tools
         env:
-          GH_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
-          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
+          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           MOKO_CLONE_HOST: ${{ secrets.GA_TOKEN && 'git.mokoconsulting.tech/MokoConsulting' || 'github.com/mokoconsulting-tech' }}
           COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_TOKEN || github.token }}"}}'
         run: |
@@ -277,7 +277,7 @@ jobs:
           steps.version.outputs.skip != 'true' &&
           steps.check.outputs.tag_exists != 'true'
         env:
-          GH_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
         run: |
           VERSION="${{ steps.version.outputs.version }}"
           RELEASE_TAG="${{ steps.version.outputs.release_tag }}"
diff --git a/templates/workflows/shared/branch-freeze.yml.template b/templates/workflows/shared/branch-freeze.yml.template
index c1f2558..c5063d5 100644
--- a/templates/workflows/shared/branch-freeze.yml.template
+++ b/templates/workflows/shared/branch-freeze.yml.template
@@ -41,7 +41,7 @@ jobs:
     steps:
       - name: Check permissions
         env:
-          GH_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
         run: |
           ACTOR="${{ github.actor }}"
           REPO="${{ github.repository }}"
@@ -54,7 +54,7 @@ jobs:
 
       - name: "${{ inputs.action }} branch"
         env:
-          GH_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
         run: |
           BRANCH="${{ inputs.branch }}"
           ACTION="${{ inputs.action }}"
diff --git a/templates/workflows/shared/deploy-demo.yml.template b/templates/workflows/shared/deploy-demo.yml.template
index aa4dca7..50eb384 100644
--- a/templates/workflows/shared/deploy-demo.yml.template
+++ b/templates/workflows/shared/deploy-demo.yml.template
@@ -76,7 +76,7 @@ jobs:
           # Prefer the org-scoped GH_TOKEN secret (needed for the org membership
           # fallback). Falls back to the built-in github.token so the collaborator
           # endpoint still works even if GH_TOKEN is not configured.
-          GH_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
         run: |
           ACTOR="${{ github.actor }}"
           REPO="${{ github.repository }}"
@@ -406,8 +406,8 @@ jobs:
       - name: Setup MokoStandards deploy tools
         if: steps.source.outputs.skip == 'false' && steps.remote.outputs.skip != 'true'
         env:
-          GH_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
-          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
+          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           MOKO_CLONE_HOST: ${{ secrets.GA_TOKEN && 'git.mokoconsulting.tech/MokoConsulting' || 'github.com/mokoconsulting-tech' }}
           COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_TOKEN || github.token }}"}}'
         run: |
@@ -634,7 +634,7 @@ jobs:
       - name: Create or update failure issue
         if: failure() && steps.remote.outputs.skip != 'true' && steps.conn.outputs.skip != 'true'
         env:
-          GH_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
         run: |
           REPO="${{ github.repository }}"
           RUN_URL="${{ github.server_url }}/${REPO}/actions/runs/${{ github.run_id }}"
diff --git a/templates/workflows/shared/deploy-dev.yml.template b/templates/workflows/shared/deploy-dev.yml.template
index 880e30c..ad9a0e6 100644
--- a/templates/workflows/shared/deploy-dev.yml.template
+++ b/templates/workflows/shared/deploy-dev.yml.template
@@ -80,7 +80,7 @@ jobs:
           # Prefer the org-scoped GH_TOKEN secret (needed for the org membership
           # fallback). Falls back to the built-in github.token so the collaborator
           # endpoint still works even if GH_TOKEN is not configured.
-          GH_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
         run: |
           ACTOR="${{ github.actor }}"
           REPO="${{ github.repository }}"
@@ -405,8 +405,8 @@ jobs:
       - name: Setup MokoStandards deploy tools
         if: steps.source.outputs.skip == 'false' && steps.remote.outputs.skip != 'true'
         env:
-          GH_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
-          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
+          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           MOKO_CLONE_HOST: ${{ secrets.GA_TOKEN && 'git.mokoconsulting.tech/MokoConsulting' || 'github.com/mokoconsulting-tech' }}
           COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_TOKEN || github.token }}"}}'
         run: |
diff --git a/templates/workflows/shared/deploy-rs.yml.template b/templates/workflows/shared/deploy-rs.yml.template
index 2bcbb74..66201f2 100644
--- a/templates/workflows/shared/deploy-rs.yml.template
+++ b/templates/workflows/shared/deploy-rs.yml.template
@@ -84,7 +84,7 @@ jobs:
           # Prefer the org-scoped GH_TOKEN secret (needed for the org membership
           # fallback). Falls back to the built-in github.token so the collaborator
           # endpoint still works even if GH_TOKEN is not configured.
-          GH_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
         run: |
           ACTOR="${{ github.actor }}"
           REPO="${{ github.repository }}"
@@ -402,8 +402,8 @@ jobs:
       - name: Setup MokoStandards deploy tools
         if: steps.source.outputs.skip == 'false' && steps.remote.outputs.skip != 'true'
         env:
-          GH_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
-          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
+          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           MOKO_CLONE_HOST: ${{ secrets.GA_TOKEN && 'git.mokoconsulting.tech/MokoConsulting' || 'github.com/mokoconsulting-tech' }}
           COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_TOKEN || github.token }}"}}'
         run: |
@@ -576,7 +576,7 @@ jobs:
       - name: Create or update failure issue
         if: failure() && steps.remote.outputs.skip != 'true' && steps.conn.outputs.skip != 'true'
         env:
-          GH_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
         run: |
           REPO="${{ github.repository }}"
           RUN_URL="${{ github.server_url }}/${REPO}/actions/runs/${{ github.run_id }}"
diff --git a/templates/workflows/shared/repository-cleanup.yml.template b/templates/workflows/shared/repository-cleanup.yml.template
index 5241cd5..ac08cff 100644
--- a/templates/workflows/shared/repository-cleanup.yml.template
+++ b/templates/workflows/shared/repository-cleanup.yml.template
@@ -67,12 +67,12 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
-          token: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          token: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           fetch-depth: 0
 
       - name: Check actor permission
         env:
-          GH_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
         run: |
           ACTOR="${{ github.actor }}"
           # Schedule triggers use github-actions[bot]
@@ -185,7 +185,7 @@ jobs:
       - name: Reset labels to standard set
         if: steps.tasks.outputs.reset_labels == 'true'
         env:
-          GH_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
         run: |
           REPO="${{ github.repository }}"
           echo "## 🏷️ Label Reset" >> $GITHUB_STEP_SUMMARY
@@ -267,7 +267,7 @@ jobs:
       - name: Delete old sync branches
         if: steps.tasks.outputs.clean_branches == 'true'
         env:
-          GH_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
         run: |
           REPO="${{ github.repository }}"
           CURRENT="chore/sync-mokostandards-v04.05"
@@ -295,7 +295,7 @@ jobs:
       - name: Clean up workflow runs
         if: steps.tasks.outputs.clean_workflows == 'true'
         env:
-          GH_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
         run: |
           REPO="${{ github.repository }}"
           echo "## 🔄 Workflow Run Cleanup" >> $GITHUB_STEP_SUMMARY
@@ -317,7 +317,7 @@ jobs:
       - name: Delete old workflow run logs
         if: steps.tasks.outputs.clean_logs == 'true'
         env:
-          GH_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
         run: |
           REPO="${{ github.repository }}"
           CUTOFF=$(date -u -d '30 days ago' +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -v-30d +%Y-%m-%dT%H:%M:%SZ)
@@ -494,7 +494,7 @@ jobs:
       - name: Delete old closed issues
         if: steps.tasks.outputs.delete_closed_issues == 'true'
         env:
-          GH_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
         run: |
           REPO="${{ github.repository }}"
           CUTOFF=$(date -u -d '30 days ago' +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -v-30d +%Y-%m-%dT%H:%M:%SZ)
diff --git a/templates/workflows/shared/sync-version-on-merge.yml.template b/templates/workflows/shared/sync-version-on-merge.yml.template
index 8eda567..ef51660 100644
--- a/templates/workflows/shared/sync-version-on-merge.yml.template
+++ b/templates/workflows/shared/sync-version-on-merge.yml.template
@@ -46,7 +46,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
-          token: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          token: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           fetch-depth: 0
 
       - name: Set up PHP
@@ -57,8 +57,8 @@ jobs:
 
       - name: Setup MokoStandards tools
         env:
-          GH_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
-          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
+          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           MOKO_CLONE_HOST: ${{ secrets.GA_TOKEN && 'git.mokoconsulting.tech/MokoConsulting' || 'github.com/mokoconsulting-tech' }}
           COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_TOKEN || github.token }}"}}'
         run: |
@@ -110,7 +110,7 @@ jobs:
             --create-issue \
             --repo "${{ github.repository }}"
         env:
-          GH_TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
 
       - name: Commit updated files
         if: ${{ steps.readme_version.outputs.skip != 'true' && inputs.dry_run != true }}
diff --git a/templates/workflows/terraform/manage-repo-templates.yml.template b/templates/workflows/terraform/manage-repo-templates.yml.template
index 6b20422..e2abd29 100644
--- a/templates/workflows/terraform/manage-repo-templates.yml.template
+++ b/templates/workflows/terraform/manage-repo-templates.yml.template
@@ -79,7 +79,7 @@ jobs:
 
       - name: Configure GitHub Token
         run: |
-          echo "GH_TOKEN=${{ secrets.ORG_ADMIN_TOKEN || secrets.GH_TOKEN }}" >> $GITHUB_ENV
+          echo "GH_TOKEN=${{ secrets.ORG_ADMIN_TOKEN || secrets.GA_TOKEN }}" >> $GITHUB_ENV
 
       - name: Create Terraform Configuration
         run: |
@@ -219,7 +219,7 @@ jobs:
           REPOS_JSON=$(cat repos.txt | jq -R -s -c 'split("\n") | map(select(length > 0))')
           echo "repos_json=${REPOS_JSON}" >> $GITHUB_OUTPUT
         env:
-          GH_TOKEN: ${{ secrets.ORG_ADMIN_TOKEN || secrets.GH_TOKEN }}
+          GH_TOKEN: ${{ secrets.ORG_ADMIN_TOKEN || secrets.GA_TOKEN }}
 
       - name: Create Terraform Variables
         run: |
diff --git a/templates/workflows/validate-joomla-project.yml b/templates/workflows/validate-joomla-project.yml
index 7ee2f3e..92aa5be 100644
--- a/templates/workflows/validate-joomla-project.yml
+++ b/templates/workflows/validate-joomla-project.yml
@@ -114,7 +114,7 @@ jobs:
       - name: Comment PR with results
         if: github.event_name == 'pull_request'
         env:
-          TOKEN: ${{ secrets.GA_TOKEN || secrets.GH_TOKEN || github.token }}
+          TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
           REPO: ${{ github.repository }}
         run: |