diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml
index 096f0878..9c751d6b 100644
--- a/.github/workflows/documentation.yml
+++ b/.github/workflows/documentation.yml
@@ -9,6 +9,25 @@ on:
 jobs:
   deploy:
     uses: ConductionNL/.github/.github/workflows/documentation.yml@main
+    # A reusable workflow receives NO secrets by default. Without this block
+    # `secrets.CF_API_TOKEN` is empty inside the callee, its "Publish to the
+    # Cloudflare Worker" step skips itself on its own guard, and the run
+    # finishes GREEN having written only gh-pages — which nothing serves. The
+    # live site never changes and no check goes red to say so.
+    #
+    # Mapped explicitly rather than `secrets: inherit`, because `inherit`
+    # hands the callee EVERY secret this repo holds — signing cert and key,
+    # appstore token, deploy keys — for the sake of two Cloudflare values.
+    # This way only those two cross the boundary.
+    #
+    # The names also differ on each side (org `CLOUDFLARE_*`, callee `CF_*`),
+    # and `inherit` passes secrets under their ORIGINAL names — so it would
+    # have left `CF_API_TOKEN` empty even setting the exposure aside. Needs
+    # ConductionNL/.github#568: a mapping only compiles for secrets the callee
+    # declares.
+    secrets:
+      CF_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      CF_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
     with:
       # `keepiq.conduction.nl` resolves as of 2026-08-23 — attached as a second
       # custom domain on the SAME `doriath-docs` worker that serves