diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dd64727cb..45c866d95 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -117,7 +117,7 @@ jobs:
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
-          SOCKET_API_KEY: ${{ secrets.SOCKET_API_KEY }} # zizmor: ignore[secrets-outside-env]
+          SOCKET_API_KEY: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }} # zizmor: ignore[secrets-outside-env]
         run: | # zizmor: ignore[github-env]
           # Pinned version + per-platform checksum pairs. Bumping a tool
           # requires updating the matching version AND every platform's
@@ -293,7 +293,7 @@ jobs:
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
-          SOCKET_API_KEY: ${{ secrets.SOCKET_API_KEY }} # zizmor: ignore[secrets-outside-env]
+          SOCKET_API_KEY: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }} # zizmor: ignore[secrets-outside-env]
         run: | # zizmor: ignore[github-env]
           # Pinned version + per-platform checksum pairs. Bumping a tool
           # requires updating the matching version AND every platform's
@@ -475,7 +475,7 @@ jobs:
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
-          SOCKET_API_KEY: ${{ secrets.SOCKET_API_KEY }} # zizmor: ignore[secrets-outside-env]
+          SOCKET_API_KEY: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }} # zizmor: ignore[secrets-outside-env]
         run: | # zizmor: ignore[github-env]
           # Pinned version + per-platform checksum pairs. Bumping a tool
           # requires updating the matching version AND every platform's
diff --git a/.github/workflows/e2e-tests.yml b/.github/workflows/e2e-tests.yml
index ddf8a611c..6015be6a6 100644
--- a/.github/workflows/e2e-tests.yml
+++ b/.github/workflows/e2e-tests.yml
@@ -162,7 +162,7 @@ jobs:
       - name: Probe tier1 legacy_mode (DIAGNOSTIC - REMOVE AFTER USE)
         if: matrix.node-version == 22
         env:
-          SOCKET_CLI_API_TOKEN: ${{ secrets.SOCKET_API_TOKEN }} # zizmor: ignore[secrets-outside-env]
+          SOCKET_CLI_API_TOKEN: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }} # zizmor: ignore[secrets-outside-env]
         run: |
           set -eu
           auth=$(printf '%s:' "$SOCKET_CLI_API_TOKEN" | base64 -w0)
@@ -186,5 +186,5 @@ jobs:
 
       - name: Run e2e tests
         env:
-          SOCKET_CLI_API_TOKEN: ${{ secrets.SOCKET_API_TOKEN }} # zizmor: ignore[secrets-outside-env]
+          SOCKET_CLI_API_TOKEN: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }} # zizmor: ignore[secrets-outside-env]
         run: pnpm run e2e-tests
diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index bd418d577..d7ecf9b4e 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -206,7 +206,7 @@ jobs:
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
-          SOCKET_API_KEY: ${{ secrets.SOCKET_API_KEY }} # zizmor: ignore[secrets-outside-env]
+          SOCKET_API_KEY: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }} # zizmor: ignore[secrets-outside-env]
         run: | # zizmor: ignore[github-env]
           # Pinned version + per-platform checksum pairs. Bumping a tool
           # requires updating the matching version AND every platform's