diff --git a/FORK.md b/FORK.md
index f696614307422..b2dcded751aba 100644
--- a/FORK.md
+++ b/FORK.md
@@ -67,9 +67,9 @@ nothing. When Claude cannot resolve it, every run of that pair fails: sync `coll
 then `gh workflow run fork-release.yml` (`-f force=true` asks Claude again instead).
 
 Watcher setup (once, or after the token expires), from `fork/upstream-nightly-watcher/`:
-`npx wrangler deploy`, then `npx wrangler secret put GITHUB_TOKEN` with a fine-grained token
-for `collissimo/t3code` (Contents: read and write, Actions: read). `npx wrangler tail` shows
-each check.
+`npx wrangler deploy`, then copy a fine-grained token for `collissimo/t3code` (Contents: read and
+write, Actions: read) and run `Get-Clipboard | npx wrangler secret put GITHUB_TOKEN`. Pasting
+into the hidden prompt instead can store a raw Ctrl+V. `npx wrangler tail` shows each check.
 
 - Every machine must run a fork build once (installed by hand); from then on the update button,
   including "update everything" for connected servers, stays on the fork. A desktop app on the
diff --git a/fork/upstream-nightly-watcher/worker.js b/fork/upstream-nightly-watcher/worker.js
index e1d64a4d5210f..7bbf84889a9ea 100644
--- a/fork/upstream-nightly-watcher/worker.js
+++ b/fork/upstream-nightly-watcher/worker.js
@@ -8,7 +8,8 @@ async function github(env, path, init = {}) {
     ...init,
     headers: {
       accept: "application/vnd.github+json",
-      authorization: `Bearer ${env.GITHUB_TOKEN}`,
+      // A pasted secret can keep a trailing CR, which GitHub rejects with an empty 400.
+      authorization: `Bearer ${env.GITHUB_TOKEN.trim()}`,
       "user-agent": "t3code-upstream-nightly-watcher",
       "x-github-api-version": "2022-11-28",
       ...init.headers,