diff --git a/docs/automation/repo-cleanup.md b/docs/automation/repo-cleanup.md
index f34ce79..e891f48 100644
--- a/docs/automation/repo-cleanup.md
+++ b/docs/automation/repo-cleanup.md
@@ -78,8 +78,8 @@ The `custom/` directory is auto-created by the cleanup workflow if it doesn't ex
 
 ### Authorization
 
-- **Schedule:** Always authorized (runs as github-actions[bot])
-- **Manual dispatch:** `jmiller-moko` and `github-actions[bot]` always authorized; others need admin/maintain role
+- **Schedule:** Always authorized (runs as gitea-actions[bot])
+- **Manual dispatch:** `jmiller-moko` and `gitea-actions[bot]` always authorized; others need admin/maintain role
 
 ---
 
diff --git a/docs/workflows/auto-release.md b/docs/workflows/auto-release.md
index 6799394..64bac6f 100644
--- a/docs/workflows/auto-release.md
+++ b/docs/workflows/auto-release.md
@@ -56,7 +56,7 @@ Joomla repos do **not** use FTP deploy. Distribution is via GitHub Release ZIPs.
 ## Triggers
 
 - Push to `main` or `master`
-- Skips commits by `github-actions[bot]` and commits with `[skip ci]`
+- Skips commits by `gitea-actions[bot]` and commits with `[skip ci]`
 
 ## Version Lifecycle
 
diff --git a/docs/workflows/build-release.md b/docs/workflows/build-release.md
index 7ccafd3..c30a3b7 100644
--- a/docs/workflows/build-release.md
+++ b/docs/workflows/build-release.md
@@ -41,7 +41,7 @@ Push to main
 ## Triggers
 
 - Push to `main` or `master`
-- Skips commits by `github-actions[bot]` and commits with `[skip ci]`
+- Skips commits by `gitea-actions[bot]` and commits with `[skip ci]`
 - Skips if tag + branch already exist (idempotent)
 
 ## What Each Step Does
diff --git a/docs/workflows/demo-deployment.md b/docs/workflows/demo-deployment.md
index 9b1085d..d2807c2 100644
--- a/docs/workflows/demo-deployment.md
+++ b/docs/workflows/demo-deployment.md
@@ -51,7 +51,7 @@ At least one of `DEMO_FTP_KEY` or `DEMO_FTP_PASSWORD` must be set.
 
 ## Behaviour
 
-1. **Permission check** — `jmiller-moko` and `github-actions[bot]` are always authorized; other actors need `admin` or `maintain` role
+1. **Permission check** — `jmiller-moko` and `gitea-actions[bot]` are always authorized; other actors need `admin` or `maintain` role
 2. **Skip on chore/ branches** — PRs from `chore/` branches do not trigger deployment
 3. **Skip if DEMO_FTP_SUFFIX not set** — repos without the variable are silently skipped
 4. **Clear remote folder** — always clears the remote destination before uploading
diff --git a/docs/workflows/dev-deployment.md b/docs/workflows/dev-deployment.md
index 6ed4e0e..47cfe67 100644
--- a/docs/workflows/dev-deployment.md
+++ b/docs/workflows/dev-deployment.md
@@ -28,7 +28,7 @@ The `deploy-dev.yml` workflow pushes the contents of `src/` to a development ser
 - A pull request targeting those branches is **merged** (skips `chore/` branches)
 - Triggered manually via workflow dispatch
 
-**Access control:** `jmiller-moko` and `github-actions[bot]` are always authorized. Other actors need **admin** or **maintain** role.
+**Access control:** `jmiller-moko` and `gitea-actions[bot]` are always authorized. Other actors need **admin** or **maintain** role.
 
 **Skips when:** `DEV_FTP_SUFFIX` variable is not set, or the branch starts with `chore/`.
 
diff --git a/docs/workflows/release-system.md b/docs/workflows/release-system.md
index 6d97c6a..b40a9e6 100644
--- a/docs/workflows/release-system.md
+++ b/docs/workflows/release-system.md
@@ -133,7 +133,7 @@ To prevent automatic release creation, include `[skip ci]` in your commit messag
 git commit -m "docs: update README [skip ci]"
 ```
 
-Commits by `github-actions[bot]` are also skipped automatically (e.g., auto-bump commits).
+Commits by `gitea-actions[bot]` are also skipped automatically (e.g., auto-bump commits).
 
 ## Architecture
 
diff --git a/docs/workflows/shared-workflows.md b/docs/workflows/shared-workflows.md
index b9878ad..2577de6 100644
--- a/docs/workflows/shared-workflows.md
+++ b/docs/workflows/shared-workflows.md
@@ -55,7 +55,7 @@ These workflows are synced to every governed repository via `bulk_sync.php`. The
 
 **Requirements:** `secrets.GH_TOKEN` with write access
 
-**Skips:** Commits by `github-actions[bot]`, commits with `[skip ci]`
+**Skips:** Commits by `gitea-actions[bot]`, commits with `[skip ci]`
 
 ---
 
@@ -108,7 +108,7 @@ See dedicated docs:
 
 ### Common Features (both deploy workflows)
 
-- **Permission check:** `jmiller-moko` and `github-actions[bot]` hardcoded as authorized; others need `admin`/`maintain` role
+- **Permission check:** `jmiller-moko` and `gitea-actions[bot]` hardcoded as authorized; others need `admin`/`maintain` role
 - **Chore skip:** PRs from `chore/` branches do not deploy
 - **Suffix required:** `{ENV}_FTP_SUFFIX` must be set or deployment is skipped
 - **Clear before upload:** Remote folder is always cleared before uploading
diff --git a/templates/workflows/dolibarr/auto-release.yml.template b/templates/workflows/dolibarr/auto-release.yml.template
index 45384a0..e564429 100644
--- a/templates/workflows/dolibarr/auto-release.yml.template
+++ b/templates/workflows/dolibarr/auto-release.yml.template
@@ -68,7 +68,7 @@ jobs:
           GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           MOKO_CLONE_HOST: ${{ secrets.GA_TOKEN && 'git.mokoconsulting.tech/MokoConsulting' || 'github.com/mokoconsulting-tech' }}
-          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_TOKEN || github.token }}"}}'
+          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GA_TOKEN || github.token }}"}}'
         run: |
           git clone --depth 1 --branch {{standards_branch}} --quiet \
             "https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoStandards-API.git" \
@@ -282,11 +282,11 @@ jobs:
             exit 0
           fi
           VERSION="${{ steps.version.outputs.version }}"
-          git config --local user.email "github-actions[bot]@users.noreply.github.com"
-          git config --local user.name "github-actions[bot]"
+          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "gitea-actions[bot]"
           git add -A
           git commit -m "chore(release): build ${VERSION} [skip ci]" \
-            --author="github-actions[bot] <github-actions[bot]@users.noreply.github.com>"
+            --author="gitea-actions[bot] <gitea-actions[bot]@mokoconsulting.tech>"
           git push
 
       # -- STEP 6: Create tag ---------------------------------------------------
diff --git a/templates/workflows/dolibarr/ci-dolibarr.yml.template b/templates/workflows/dolibarr/ci-dolibarr.yml.template
index edf752f..e284284 100644
--- a/templates/workflows/dolibarr/ci-dolibarr.yml.template
+++ b/templates/workflows/dolibarr/ci-dolibarr.yml.template
@@ -58,7 +58,7 @@ jobs:
 
       - name: Install dependencies
         env:
-          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_TOKEN || github.token }}"}}'
+          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GA_TOKEN || github.token }}"}}'
         run: |
           if [ -f "composer.json" ]; then
             composer install \
@@ -276,7 +276,7 @@ jobs:
 
       - name: Install dependencies
         env:
-          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_TOKEN || github.token }}"}}'
+          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GA_TOKEN || github.token }}"}}'
         run: |
           if [ -f "composer.json" ]; then
             composer install \
diff --git a/templates/workflows/joomla/auto-release.yml.template b/templates/workflows/joomla/auto-release.yml.template
index 8e3828e..d26e3ac 100644
--- a/templates/workflows/joomla/auto-release.yml.template
+++ b/templates/workflows/joomla/auto-release.yml.template
@@ -391,11 +391,11 @@ jobs:
             exit 0
           fi
           VERSION="${{ steps.version.outputs.version }}"
-          git config --local user.email "github-actions[bot]@users.noreply.github.com"
-          git config --local user.name "github-actions[bot]"
+          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "gitea-actions[bot]"
           git add -A
           git commit -m "chore(release): build ${VERSION} [skip ci]" \
-            --author="github-actions[bot] <github-actions[bot]@users.noreply.github.com>"
+            --author="gitea-actions[bot] <gitea-actions[bot]@mokoconsulting.tech>"
           git push
 
       # -- STEP 6: Create tag ---------------------------------------------------
@@ -594,7 +594,7 @@ jobs:
 
             git add updates.xml
             git commit -m "chore(release): ZIP + tar.gz for ${VERSION} [skip ci]" \
-              --author="github-actions[bot] <github-actions[bot]@users.noreply.github.com>" || true
+              --author="gitea-actions[bot] <gitea-actions[bot]@mokoconsulting.tech>" || true
             git push || true
           fi
 
diff --git a/templates/workflows/joomla/ci-joomla.yml.template b/templates/workflows/joomla/ci-joomla.yml.template
index 4474a62..a52d359 100644
--- a/templates/workflows/joomla/ci-joomla.yml.template
+++ b/templates/workflows/joomla/ci-joomla.yml.template
@@ -58,7 +58,7 @@ jobs:
 
       - name: Install dependencies
         env:
-          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_TOKEN || github.token }}"}}'
+          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GA_TOKEN || github.token }}"}}'
         run: |
           if [ -f "composer.json" ]; then
             composer install \
@@ -355,7 +355,7 @@ jobs:
 
       - name: Install dependencies
         env:
-          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_TOKEN || github.token }}"}}'
+          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GA_TOKEN || github.token }}"}}'
         run: |
           if [ -f "composer.json" ]; then
             composer install \
diff --git a/templates/workflows/joomla/deploy-manual.yml.template b/templates/workflows/joomla/deploy-manual.yml.template
index a5fa9ae..49f7cee 100644
--- a/templates/workflows/joomla/deploy-manual.yml.template
+++ b/templates/workflows/joomla/deploy-manual.yml.template
@@ -51,7 +51,7 @@ jobs:
           GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           MOKO_CLONE_HOST: ${{ secrets.GA_TOKEN && 'git.mokoconsulting.tech/MokoConsulting' || 'github.com/mokoconsulting-tech' }}
-          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_TOKEN || github.token }}"}}'
+          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GA_TOKEN || github.token }}"}}'
         run: |
           git clone --depth 1 --branch {{standards_branch}} --quiet \
             "https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoStandards-API.git" \
diff --git a/templates/workflows/joomla/update-server.yml.template b/templates/workflows/joomla/update-server.yml.template
index 6457116..eacb9d6 100644
--- a/templates/workflows/joomla/update-server.yml.template
+++ b/templates/workflows/joomla/update-server.yml.template
@@ -90,14 +90,14 @@ jobs:
 
           # Auto-bump patch on alpha/beta/rc branches (not dev — dev bumps manually)
           if [[ "$BRANCH" != dev/* ]]; then
-            git config --local user.email "github-actions[bot]@users.noreply.github.com"
-            git config --local user.name "github-actions[bot]"
+            git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+            git config --local user.name "gitea-actions[bot]"
             BUMPED=$(php /tmp/mokostandards-api/cli/version_bump.php --path . 2>/dev/null || true)
             if [ -n "$BUMPED" ]; then
               VERSION=$(php /tmp/mokostandards-api/cli/version_read.php --path . 2>/dev/null || echo "$VERSION")
               git add -A
               git commit -m "chore(version): auto-bump patch ${VERSION} [skip ci]" \
-                --author="github-actions[bot] <github-actions[bot]@users.noreply.github.com>" 2>/dev/null || true
+                --author="gitea-actions[bot] <gitea-actions[bot]@mokoconsulting.tech>" 2>/dev/null || true
               git push 2>/dev/null || true
             fi
           fi
@@ -325,12 +325,12 @@ jobs:
           fi
 
           # Commit
-          git config --local user.email "github-actions[bot]@users.noreply.github.com"
-          git config --local user.name "github-actions[bot]"
+          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "gitea-actions[bot]"
           git add updates.xml
           git diff --cached --quiet || {
             git commit -m "chore: update updates.xml (${STABILITY}: ${DISPLAY_VERSION}) [skip ci]" \
-              --author="github-actions[bot] <github-actions[bot]@users.noreply.github.com>"
+              --author="gitea-actions[bot] <gitea-actions[bot]@mokoconsulting.tech>"
             git push
           }
 
diff --git a/templates/workflows/shared/auto-release.yml.template b/templates/workflows/shared/auto-release.yml.template
index 9b6b9ef..5964d28 100644
--- a/templates/workflows/shared/auto-release.yml.template
+++ b/templates/workflows/shared/auto-release.yml.template
@@ -67,7 +67,7 @@ jobs:
           GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           MOKO_CLONE_HOST: ${{ secrets.GA_TOKEN && 'git.mokoconsulting.tech/MokoConsulting' || 'github.com/mokoconsulting-tech' }}
-          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_TOKEN || github.token }}"}}'
+          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GA_TOKEN || github.token }}"}}'
         run: |
           git clone --depth 1 --branch {{standards_branch}} --quiet \
             "https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoStandards-API.git" \
@@ -246,11 +246,11 @@ jobs:
             exit 0
           fi
           VERSION="${{ steps.version.outputs.version }}"
-          git config --local user.email "github-actions[bot]@users.noreply.github.com"
-          git config --local user.name "github-actions[bot]"
+          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "gitea-actions[bot]"
           git add -A
           git commit -m "chore(release): build ${VERSION} [skip ci]" \
-            --author="github-actions[bot] <github-actions[bot]@users.noreply.github.com>"
+            --author="gitea-actions[bot] <gitea-actions[bot]@mokoconsulting.tech>"
           git push
 
       # -- STEP 6: Create tag ---------------------------------------------------
diff --git a/templates/workflows/shared/deploy-demo.yml.template b/templates/workflows/shared/deploy-demo.yml.template
index 8eb36ea..a1b7503 100644
--- a/templates/workflows/shared/deploy-demo.yml.template
+++ b/templates/workflows/shared/deploy-demo.yml.template
@@ -86,7 +86,7 @@ jobs:
           AUTHORIZED="false"
 
           # Hardcoded authorized users — always allowed to deploy
-          AUTHORIZED_USERS="jmiller-moko github-actions[bot]"
+          AUTHORIZED_USERS="jmiller-moko gitea-actions[bot]"
           for user in $AUTHORIZED_USERS; do
             if [ "$ACTOR" = "$user" ]; then
               AUTHORIZED="true"
@@ -103,7 +103,7 @@ jobs:
             METHOD="repo collaborator API"
 
             if [ -z "$PERMISSION" ]; then
-              ORG_ROLE=$(gh api "orgs/${ORG}/memberships/${ACTOR}" \
+              ORG_ROLE=$(curl -sf -H "Authorization: token ${{ secrets.GA_TOKEN }}" "${GITEA_URL:-https://git.mokoconsulting.tech}/api/v1/orgs/${ORG}/memberships/${ACTOR}" \
                 --jq '.role' 2>/dev/null)
               METHOD="org membership API"
               if [ "$ORG_ROLE" = "owner" ]; then
@@ -409,7 +409,7 @@ jobs:
           GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           MOKO_CLONE_HOST: ${{ secrets.GA_TOKEN && 'git.mokoconsulting.tech/MokoConsulting' || 'github.com/mokoconsulting-tech' }}
-          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_TOKEN || github.token }}"}}'
+          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GA_TOKEN || github.token }}"}}'
         run: |
           git clone --depth 1 --branch {{standards_branch}} --quiet \
             "https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoStandards-API.git" \
diff --git a/templates/workflows/shared/deploy-dev.yml.template b/templates/workflows/shared/deploy-dev.yml.template
index 25b0861..eea4132 100644
--- a/templates/workflows/shared/deploy-dev.yml.template
+++ b/templates/workflows/shared/deploy-dev.yml.template
@@ -90,7 +90,7 @@ jobs:
           AUTHORIZED="false"
 
           # Hardcoded authorized users — always allowed to deploy
-          AUTHORIZED_USERS="jmiller-moko github-actions[bot]"
+          AUTHORIZED_USERS="jmiller-moko gitea-actions[bot]"
           for user in $AUTHORIZED_USERS; do
             if [ "$ACTOR" = "$user" ]; then
               AUTHORIZED="true"
@@ -107,7 +107,7 @@ jobs:
             METHOD="repo collaborator API"
 
             if [ -z "$PERMISSION" ]; then
-              ORG_ROLE=$(gh api "orgs/${ORG}/memberships/${ACTOR}" \
+              ORG_ROLE=$(curl -sf -H "Authorization: token ${{ secrets.GA_TOKEN }}" "${GITEA_URL:-https://git.mokoconsulting.tech}/api/v1/orgs/${ORG}/memberships/${ACTOR}" \
                 --jq '.role' 2>/dev/null)
               METHOD="org membership API"
               if [ "$ORG_ROLE" = "owner" ]; then
@@ -408,7 +408,7 @@ jobs:
           GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           MOKO_CLONE_HOST: ${{ secrets.GA_TOKEN && 'git.mokoconsulting.tech/MokoConsulting' || 'github.com/mokoconsulting-tech' }}
-          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_TOKEN || github.token }}"}}'
+          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GA_TOKEN || github.token }}"}}'
         run: |
           git clone --depth 1 --branch {{standards_branch}} --quiet \
             "https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoStandards-API.git" \
diff --git a/templates/workflows/shared/deploy-rs.yml.template b/templates/workflows/shared/deploy-rs.yml.template
index 9ace550..b1b4072 100644
--- a/templates/workflows/shared/deploy-rs.yml.template
+++ b/templates/workflows/shared/deploy-rs.yml.template
@@ -94,7 +94,7 @@ jobs:
           AUTHORIZED="false"
 
           # Hardcoded authorized users — always allowed to deploy
-          AUTHORIZED_USERS="jmiller-moko github-actions[bot]"
+          AUTHORIZED_USERS="jmiller-moko gitea-actions[bot]"
           for user in $AUTHORIZED_USERS; do
             if [ "$ACTOR" = "$user" ]; then
               AUTHORIZED="true"
@@ -111,7 +111,7 @@ jobs:
             METHOD="repo collaborator API"
 
             if [ -z "$PERMISSION" ]; then
-              ORG_ROLE=$(gh api "orgs/${ORG}/memberships/${ACTOR}" \
+              ORG_ROLE=$(curl -sf -H "Authorization: token ${{ secrets.GA_TOKEN }}" "${GITEA_URL:-https://git.mokoconsulting.tech}/api/v1/orgs/${ORG}/memberships/${ACTOR}" \
                 --jq '.role' 2>/dev/null)
               METHOD="org membership API"
               if [ "$ORG_ROLE" = "owner" ]; then
@@ -405,7 +405,7 @@ jobs:
           GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           MOKO_CLONE_HOST: ${{ secrets.GA_TOKEN && 'git.mokoconsulting.tech/MokoConsulting' || 'github.com/mokoconsulting-tech' }}
-          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_TOKEN || github.token }}"}}'
+          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GA_TOKEN || github.token }}"}}'
         run: |
           git clone --depth 1 --branch {{standards_branch}} --quiet \
             "https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoStandards-API.git" \
diff --git a/templates/workflows/shared/repository-cleanup.yml.template b/templates/workflows/shared/repository-cleanup.yml.template
index 7e9889d..5c56540 100644
--- a/templates/workflows/shared/repository-cleanup.yml.template
+++ b/templates/workflows/shared/repository-cleanup.yml.template
@@ -75,19 +75,19 @@ jobs:
           GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
         run: |
           ACTOR="${{ github.actor }}"
-          # Schedule triggers use github-actions[bot]
+          # Schedule triggers use gitea-actions[bot]
           if [ "${{ github.event_name }}" = "schedule" ]; then
             echo "✅ Scheduled run — authorized"
             exit 0
           fi
-          AUTHORIZED_USERS="jmiller-moko github-actions[bot]"
+          AUTHORIZED_USERS="jmiller-moko gitea-actions[bot]"
           for user in $AUTHORIZED_USERS; do
             if [ "$ACTOR" = "$user" ]; then
               echo "✅ ${ACTOR} authorized"
               exit 0
             fi
           done
-          PERMISSION=$(gh api "repos/${{ github.repository }}/collaborators/${ACTOR}/permission" \
+          PERMISSION=$(curl -sf -H "Authorization: token ${{ secrets.GA_TOKEN }}" "${{GITEA_URL:-https://git.mokoconsulting.tech}}/api/v1/repos/${{ github.repository }}/collaborators/${ACTOR}/permission" 2>/dev/null \
             --jq '.permission' 2>/dev/null)
           case "$PERMISSION" in
             admin|maintain) echo "✅ ${ACTOR} has ${PERMISSION}" ;;
@@ -170,11 +170,11 @@ jobs:
           done
 
           if [ "$DELETED" -gt 0 ]; then
-            git config --local user.email "github-actions[bot]@users.noreply.github.com"
-            git config --local user.name "github-actions[bot]"
+            git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+            git config --local user.name "gitea-actions[bot]"
             git add -A
             git commit -m "chore: delete ${DELETED} retired workflow file(s) [skip ci]" \
-              --author="github-actions[bot] <github-actions[bot]@users.noreply.github.com>"
+              --author="gitea-actions[bot] <gitea-actions[bot]@mokoconsulting.tech>"
             git push
             echo "✅ ${DELETED} retired workflow(s) deleted" >> $GITHUB_STEP_SUMMARY
           else
@@ -193,7 +193,7 @@ jobs:
 
           curl -sf -H "Authorization: token ${{ secrets.GA_TOKEN }}" "${{GITEA_URL:-https://git.mokoconsulting.tech}}/api/v1/repos/${{ github.repository }}/labels?per_page=100" 2>/dev/null --paginate --jq '.[].name' | while read -r label; do
             ENCODED=$(python3 -c "import urllib.parse; print(urllib.parse.quote('$label', safe=''))")
-            gh api -X DELETE "repos/${REPO}/labels/${ENCODED}" --silent 2>/dev/null || true
+            curl -sf -X DELETE -H "Authorization: token ${{ secrets.GA_TOKEN }}" "${{GITEA_URL:-https://git.mokoconsulting.tech}}/api/v1/repos/${{ github.repository }}/labels/${ENCODED}" 2>/dev/null || true
           done
 
           while IFS='|' read -r name color description; do
@@ -282,7 +282,7 @@ jobs:
                 gh pr close "$pr" --repo "$REPO" --comment "Superseded by \`${CURRENT}\`" 2>/dev/null || true
                 echo "  Closed PR #${pr}" >> $GITHUB_STEP_SUMMARY
               done
-              gh api -X DELETE "repos/${REPO}/git/refs/heads/${branch}" --silent 2>/dev/null || true
+              curl -sf -X DELETE -H "Authorization: token ${{ secrets.GA_TOKEN }}" "${{GITEA_URL:-https://git.mokoconsulting.tech}}/api/v1/repos/${{ github.repository }}/git/refs/heads/${branch}" 2>/dev/null || true
               echo "  Deleted: \`${branch}\`" >> $GITHUB_STEP_SUMMARY
               FOUND=true
           done
@@ -306,7 +306,7 @@ jobs:
           for status in cancelled stale; do
             curl -sf -H "Authorization: token ${{ secrets.GA_TOKEN }}" "${{GITEA_URL:-https://git.mokoconsulting.tech}}/api/v1/repos/${{ github.repository }}/actions/runs?status=${status}&per_page=100" 2>/dev/null \
               --jq '.workflow_runs[].id' 2>/dev/null | while read -r run_id; do
-                gh api -X DELETE "repos/${REPO}/actions/runs/${run_id}" --silent 2>/dev/null || true
+                curl -sf -X DELETE -H "Authorization: token ${{ secrets.GA_TOKEN }}" "${{GITEA_URL:-https://git.mokoconsulting.tech}}/api/v1/repos/${{ github.repository }}/actions/runs/${run_id}" 2>/dev/null || true
                 DELETED=$((DELETED+1))
             done
           done
@@ -328,7 +328,7 @@ jobs:
           DELETED=0
           curl -sf -H "Authorization: token ${{ secrets.GA_TOKEN }}" "${{GITEA_URL:-https://git.mokoconsulting.tech}}/api/v1/repos/${{ github.repository }}/actions/runs?created=<${CUTOFF}&per_page=100" 2>/dev/null \
             --jq '.workflow_runs[].id' 2>/dev/null | while read -r run_id; do
-              gh api -X DELETE "repos/${REPO}/actions/runs/${run_id}/logs" --silent 2>/dev/null || true
+              curl -sf -X DELETE -H "Authorization: token ${{ secrets.GA_TOKEN }}" "${{GITEA_URL:-https://git.mokoconsulting.tech}}/api/v1/repos/${{ github.repository }}/actions/runs/${run_id}/logs" 2>/dev/null || true
               DELETED=$((DELETED+1))
           done
 
@@ -352,11 +352,11 @@ jobs:
           done
 
           if [ "$FIXED" -gt 0 ]; then
-            git config --local user.email "github-actions[bot]@users.noreply.github.com"
-            git config --local user.name "github-actions[bot]"
+            git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+            git config --local user.name "gitea-actions[bot]"
             git add .github/ISSUE_TEMPLATE/
             git commit -m "fix: strip copyright comment blocks from issue templates [skip ci]" \
-              --author="github-actions[bot] <github-actions[bot]@users.noreply.github.com>"
+              --author="gitea-actions[bot] <gitea-actions[bot]@mokoconsulting.tech>"
             git push
             echo "✅ ${FIXED} template(s) cleaned and committed" >> $GITHUB_STEP_SUMMARY
           else
@@ -400,12 +400,12 @@ jobs:
           done
 
           if [ "$UPDATED" -gt 0 ]; then
-            git config --local user.email "github-actions[bot]@users.noreply.github.com"
-            git config --local user.name "github-actions[bot]"
+            git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+            git config --local user.name "gitea-actions[bot]"
             git add docs/
             if ! git diff --cached --quiet; then
               git commit -m "docs: rebuild documentation indexes [skip ci]" \
-                --author="github-actions[bot] <github-actions[bot]@users.noreply.github.com>"
+                --author="gitea-actions[bot] <gitea-actions[bot]@mokoconsulting.tech>"
               git push
               echo "✅ ${UPDATED} index file(s) rebuilt and committed" >> $GITHUB_STEP_SUMMARY
             else
@@ -476,12 +476,12 @@ jobs:
           Synced workflows live in `.github/workflows/` (parent directory).
           CWEOF
             sed -i 's/^          //' .github/workflows/custom/README.md
-            git config --local user.email "github-actions[bot]@users.noreply.github.com"
-            git config --local user.name "github-actions[bot]"
+            git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+            git config --local user.name "gitea-actions[bot]"
             git add .github/workflows/custom/
             if ! git diff --cached --quiet; then
               git commit -m "chore: create .github/workflows/custom/ for repo-specific workflows [skip ci]" \
-                --author="github-actions[bot] <github-actions[bot]@users.noreply.github.com>"
+                --author="gitea-actions[bot] <gitea-actions[bot]@mokoconsulting.tech>"
               git push
               echo "✅ Created \`.github/workflows/custom/\` directory" >> $GITHUB_STEP_SUMMARY
             fi
diff --git a/templates/workflows/shared/sync-version-on-merge.yml.template b/templates/workflows/shared/sync-version-on-merge.yml.template
index ef51660..fedcdc3 100644
--- a/templates/workflows/shared/sync-version-on-merge.yml.template
+++ b/templates/workflows/shared/sync-version-on-merge.yml.template
@@ -60,7 +60,7 @@ jobs:
           GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
           MOKO_CLONE_HOST: ${{ secrets.GA_TOKEN && 'git.mokoconsulting.tech/MokoConsulting' || 'github.com/mokoconsulting-tech' }}
-          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_TOKEN || github.token }}"}}'
+          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GA_TOKEN || github.token }}"}}'
         run: |
           git clone --depth 1 --branch {{standards_branch}} --quiet \
             "https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoStandards-API.git" \
@@ -69,7 +69,7 @@ jobs:
           composer install --no-dev --no-interaction --quiet
 
       - name: Auto-bump patch version
-        if: ${{ github.event_name != 'workflow_dispatch' && github.actor != 'github-actions[bot]' }}
+        if: ${{ github.event_name != 'workflow_dispatch' && github.actor != 'gitea-actions[bot]' }}
         run: |
           if git diff --name-only HEAD~1 HEAD 2>/dev/null | grep -q '^README\.md$'; then
             echo "README.md changed in this push — skipping auto-bump"
@@ -81,11 +81,11 @@ jobs:
             exit 0
           }
           echo "Auto-bumping patch: $RESULT"
-          git config --local user.email "github-actions[bot]@users.noreply.github.com"
-          git config --local user.name "github-actions[bot]"
+          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "gitea-actions[bot]"
           git add README.md
           git commit -m "chore(version): auto-bump patch ${RESULT} [skip ci]" \
-            --author="github-actions[bot] <github-actions[bot]@users.noreply.github.com>"
+            --author="gitea-actions[bot] <gitea-actions[bot]@mokoconsulting.tech>"
           git push
 
       - name: Extract version from README.md
@@ -121,11 +121,11 @@ jobs:
             exit 0
           fi
           VERSION="${{ steps.readme_version.outputs.version }}"
-          git config --local user.email "github-actions[bot]@users.noreply.github.com"
-          git config --local user.name "github-actions[bot]"
+          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "gitea-actions[bot]"
           git add -A
           git commit -m "chore(version): sync badges and headers to ${VERSION} [skip ci]" \
-            --author="github-actions[bot] <github-actions[bot]@users.noreply.github.com>"
+            --author="gitea-actions[bot] <gitea-actions[bot]@mokoconsulting.tech>"
           git push
 
       - name: Summary
diff --git a/templates/workflows/terraform/manage-repo-templates.yml.template b/templates/workflows/terraform/manage-repo-templates.yml.template
index e2abd29..564cba8 100644
--- a/templates/workflows/terraform/manage-repo-templates.yml.template
+++ b/templates/workflows/terraform/manage-repo-templates.yml.template
@@ -208,7 +208,7 @@ jobs:
         run: |
           if [ "${{ inputs.target_repos }}" = "all" ]; then
             # Get all org repositories
-            gh api --paginate "/orgs/${{ github.repository_owner }}/repos" \
+            curl -sf -H "Authorization: token ${{ secrets.GA_TOKEN }}" "${GITEA_URL:-https://git.mokoconsulting.tech}/api/v1/orgs/${{ github.repository_owner }}/repos?limit=50" \
               --jq '.[].name' > repos.txt
           else
             # Use specified repositories