diff --git a/.gitea/workflows/bump.yaml b/.gitea/workflows/bump.yaml
index 4fd188f..d0a41ab 100644
--- a/.gitea/workflows/bump.yaml
+++ b/.gitea/workflows/bump.yaml
@@ -26,9 +26,9 @@ jobs:
 
       - name: Check for new release and open PR
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          BUMP_TOKEN: ${{ secrets.BUMP_TOKEN }}
         run: |
           host=${GITHUB_SERVER_URL#http://}; host=${host#https://}
-          curl -fsSL "http://x-access-token:${GITEA_TOKEN}@${host}/${GITHUB_REPOSITORY}/raw/branch/master/scripts/bump-version.sh" \
+          curl -fsSL "http://x-access-token:${BUMP_TOKEN}@${host}/${GITHUB_REPOSITORY}/raw/branch/master/scripts/bump-version.sh" \
             -o /tmp/bump-version.sh
           bash /tmp/bump-version.sh
diff --git a/README.md b/README.md
index 3c056f1..5c62abc 100644
--- a/README.md
+++ b/README.md
@@ -26,5 +26,5 @@ emerge dev-util/gitea-runner
   every push and asserts the resulting binary runs.
 - `.gitea/workflows/bump.yaml` runs `scripts/bump-version.sh` daily: it checks the
   upstream releases feed and, when a newer version exists, regenerates + uploads the
-  vendor tarball, bumps the ebuild, and opens a pull request. Requires a `GITEA_TOKEN`
+  vendor tarball, bumps the ebuild, and opens a pull request. Requires a `BUMP_TOKEN`
   repository secret (scopes: repository read/write, write release).
diff --git a/scripts/bump-version.sh b/scripts/bump-version.sh
index 2904c43..2e78c55 100755
--- a/scripts/bump-version.sh
+++ b/scripts/bump-version.sh
@@ -4,7 +4,7 @@
 # ebuild, regenerate the Manifest, and open a pull request.
 #
 # Expects a Gentoo environment with: go, pkgdev, git, curl, xz, jq.
-# Required env: GITEA_TOKEN, GITHUB_SERVER_URL, GITHUB_REPOSITORY.
+# Required env: BUMP_TOKEN, GITHUB_SERVER_URL, GITHUB_REPOSITORY.
 # Optional env: GITHUB_API_URL (defaults to ${GITHUB_SERVER_URL}/api/v1).
 set -euo pipefail
 
@@ -13,13 +13,13 @@ UPSTREAM_RSS="https://gitea.com/gitea/runner/releases.rss"
 UPSTREAM_ARCHIVE="https://gitea.com/gitea/runner/archive"
 UPSTREAM_GOMOD="https://gitea.com/gitea/runner/raw/tag"
 
-: "${GITEA_TOKEN:?GITEA_TOKEN is required}"
+: "${BUMP_TOKEN:?BUMP_TOKEN is required}"
 : "${GITHUB_SERVER_URL:?GITHUB_SERVER_URL is required}"
 : "${GITHUB_REPOSITORY:?GITHUB_REPOSITORY is required}"
 API="${GITHUB_API_URL:-${GITHUB_SERVER_URL}/api/v1}"
 
 host=${GITHUB_SERVER_URL#http://}; host=${host#https://}
-api() { curl -fsSL -H "Authorization: token ${GITEA_TOKEN}" "$@"; }
+api() { curl -fsSL -H "Authorization: token ${BUMP_TOKEN}" "$@"; }
 
 # --- determine versions ------------------------------------------------------
 latest=$(curl -fsSL "$UPSTREAM_RSS" \
@@ -28,7 +28,7 @@ latest=$(curl -fsSL "$UPSTREAM_RSS" \
 [ -n "$latest" ] || { echo "could not parse upstream version"; exit 1; }
 
 WORK=$(mktemp -d)
-git clone "https://x-access-token:${GITEA_TOKEN}@${host}/${GITHUB_REPOSITORY}.git" "$WORK"
+git clone "https://x-access-token:${BUMP_TOKEN}@${host}/${GITHUB_REPOSITORY}.git" "$WORK"
 cd "$WORK"
 pkgdir="dev-util/${PN}"