diff --git a/.github/workflows/upstream-refresh.yml b/.github/workflows/upstream-refresh.yml
index 3a933d6..c281724 100644
--- a/.github/workflows/upstream-refresh.yml
+++ b/.github/workflows/upstream-refresh.yml
@@ -30,11 +30,11 @@ jobs:
     steps:
       - name: Validate GitHub App configuration
         env:
-          WORKFLOW_APP_ID: ${{ vars.LIBRECODE_WORKFLOW_APP_ID }}
+          WORKFLOW_APP_CLIENT_ID: ${{ vars.LIBRECODE_WORKFLOW_APP_CLIENT_ID }}
           WORKFLOW_APP_PRIVATE_KEY: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }}
         run: |
-          if [ -z "$WORKFLOW_APP_ID" ]; then
-            echo "::error::LIBRECODE_WORKFLOW_APP_ID is not configured."
+          if [ -z "$WORKFLOW_APP_CLIENT_ID" ]; then
+            echo "::error::LIBRECODE_WORKFLOW_APP_CLIENT_ID is not configured."
             exit 1
           fi
           if [ -z "$WORKFLOW_APP_PRIVATE_KEY" ]; then
@@ -46,7 +46,7 @@ jobs:
         id: app-token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          app-id: ${{ vars.LIBRECODE_WORKFLOW_APP_ID }}
+          client-id: ${{ vars.LIBRECODE_WORKFLOW_APP_CLIENT_ID }}
           private-key: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }}
           owner: LibreCodeCoop
           repositories: .github
diff --git a/docs/cross-repository-automation.md b/docs/cross-repository-automation.md
index 0b6842e..d451e88 100644
--- a/docs/cross-repository-automation.md
+++ b/docs/cross-repository-automation.md
@@ -22,8 +22,8 @@ The updater manages workflows already installed in the consumer repository. It r
 
 The installed updater selects authentication with the repository variable `WORKFLOW_SYNC_AUTH_MODE`:
 
-- `librecode-app` — LibreCode-managed repositories; uses `LIBRECODE_WORKFLOW_APP_ID` and `LIBRECODE_WORKFLOW_APP_PRIVATE_KEY`.
-- `github-app` — independent consumers; uses `WORKFLOW_SYNC_APP_ID` and `WORKFLOW_SYNC_APP_PRIVATE_KEY`.
+- `librecode-app` — LibreCode-managed repositories; uses `LIBRECODE_WORKFLOW_APP_CLIENT_ID` and `LIBRECODE_WORKFLOW_APP_PRIVATE_KEY`.
+- `github-app` — independent consumers; uses `WORKFLOW_SYNC_APP_CLIENT_ID` and `WORKFLOW_SYNC_APP_PRIVATE_KEY`.
 - `token` — uses `WORKFLOW_SYNC_TOKEN`.
 - `github-token` — uses the workflow `GITHUB_TOKEN`.
 
@@ -56,7 +56,7 @@ Only templates listed in `workflow-catalog.json` are published. Generated or exp
 
 Catalog publication uses the **LibreCode Workflow Automation** GitHub App. Its credentials are stored in `LibreCodeCoop/.github`:
 
-- variable `LIBRECODE_WORKFLOW_APP_ID`;
+- variable `LIBRECODE_WORKFLOW_APP_CLIENT_ID` (GitHub App Client ID);
 - secret `LIBRECODE_WORKFLOW_APP_PRIVATE_KEY`.
 
 Write-capable jobs mint short-lived installation tokens scoped to the destination repository. The private key must never be committed.
diff --git a/patches/nextcloud/sync-workflow-templates.yml.patch b/patches/nextcloud/sync-workflow-templates.yml.patch
index d4fa443..9829e17 100644
--- a/patches/nextcloud/sync-workflow-templates.yml.patch
+++ b/patches/nextcloud/sync-workflow-templates.yml.patch
@@ -50,9 +50,9 @@
 +        shell: bash
 +        env:
 +          AUTH_MODE: ${{ vars.WORKFLOW_SYNC_AUTH_MODE || 'librecode-app' }}
-+          LIBRECODE_APP_ID: ${{ vars.LIBRECODE_WORKFLOW_APP_ID }}
++          LIBRECODE_APP_CLIENT_ID: ${{ vars.LIBRECODE_WORKFLOW_APP_CLIENT_ID }}
 +          LIBRECODE_APP_PRIVATE_KEY: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }}
-+          CONSUMER_APP_ID: ${{ vars.WORKFLOW_SYNC_APP_ID }}
++          CONSUMER_APP_CLIENT_ID: ${{ vars.WORKFLOW_SYNC_APP_CLIENT_ID }}
 +          CONSUMER_APP_PRIVATE_KEY: ${{ secrets.WORKFLOW_SYNC_APP_PRIVATE_KEY }}
 +          CONSUMER_TOKEN: ${{ secrets.WORKFLOW_SYNC_TOKEN }}
 +        run: |
@@ -60,14 +60,14 @@
 +
 +          case "${AUTH_MODE}" in
 +            librecode-app)
-+              [[ -n "${LIBRECODE_APP_ID}" && -n "${LIBRECODE_APP_PRIVATE_KEY}" ]] || {
-+                echo "::error::librecode-app requires LIBRECODE_WORKFLOW_APP_ID and LIBRECODE_WORKFLOW_APP_PRIVATE_KEY"
++              [[ -n "${LIBRECODE_APP_CLIENT_ID}" && -n "${LIBRECODE_APP_PRIVATE_KEY}" ]] || {
++                echo "::error::librecode-app requires LIBRECODE_WORKFLOW_APP_CLIENT_ID and LIBRECODE_WORKFLOW_APP_PRIVATE_KEY"
 +                exit 1
 +              }
 +              ;;
 +            github-app)
-+              [[ -n "${CONSUMER_APP_ID}" && -n "${CONSUMER_APP_PRIVATE_KEY}" ]] || {
-+                echo "::error::github-app requires WORKFLOW_SYNC_APP_ID and WORKFLOW_SYNC_APP_PRIVATE_KEY"
++              [[ -n "${CONSUMER_APP_CLIENT_ID}" && -n "${CONSUMER_APP_PRIVATE_KEY}" ]] || {
++                echo "::error::github-app requires WORKFLOW_SYNC_APP_CLIENT_ID and WORKFLOW_SYNC_APP_PRIVATE_KEY"
 +                exit 1
 +              }
 +              ;;
@@ -90,7 +90,7 @@
 +        id: librecode-app-token
 +        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
 +        with:
-+          app-id: ${{ vars.LIBRECODE_WORKFLOW_APP_ID }}
++          client-id: ${{ vars.LIBRECODE_WORKFLOW_APP_CLIENT_ID }}
 +          private-key: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }}
 +          owner: ${{ github.repository_owner }}
 +          repositories: ${{ github.event.repository.name }}
@@ -104,7 +104,7 @@
 +        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
 -        uses: skjnldsv/check-actor-permission@69e92a3c4711150929bca9fcf34448c5bf5526e7 # v3.0
          with:
-+          app-id: ${{ vars.WORKFLOW_SYNC_APP_ID }}
++          client-id: ${{ vars.WORKFLOW_SYNC_APP_CLIENT_ID }}
 +          private-key: ${{ secrets.WORKFLOW_SYNC_APP_PRIVATE_KEY }}
 +          owner: ${{ github.repository_owner }}
 +          repositories: ${{ github.event.repository.name }}
diff --git a/workflow-templates/sync-workflow-templates.yml b/workflow-templates/sync-workflow-templates.yml
index 93c4201..d0afcb5 100644
--- a/workflow-templates/sync-workflow-templates.yml
+++ b/workflow-templates/sync-workflow-templates.yml
@@ -54,9 +54,9 @@ jobs:
         shell: bash
         env:
           AUTH_MODE: ${{ vars.WORKFLOW_SYNC_AUTH_MODE || 'librecode-app' }}
-          LIBRECODE_APP_ID: ${{ vars.LIBRECODE_WORKFLOW_APP_ID }}
+          LIBRECODE_APP_CLIENT_ID: ${{ vars.LIBRECODE_WORKFLOW_APP_CLIENT_ID }}
           LIBRECODE_APP_PRIVATE_KEY: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }}
-          CONSUMER_APP_ID: ${{ vars.WORKFLOW_SYNC_APP_ID }}
+          CONSUMER_APP_CLIENT_ID: ${{ vars.WORKFLOW_SYNC_APP_CLIENT_ID }}
           CONSUMER_APP_PRIVATE_KEY: ${{ secrets.WORKFLOW_SYNC_APP_PRIVATE_KEY }}
           CONSUMER_TOKEN: ${{ secrets.WORKFLOW_SYNC_TOKEN }}
         run: |
@@ -64,14 +64,14 @@ jobs:
 
           case "${AUTH_MODE}" in
             librecode-app)
-              [[ -n "${LIBRECODE_APP_ID}" && -n "${LIBRECODE_APP_PRIVATE_KEY}" ]] || {
-                echo "::error::librecode-app requires LIBRECODE_WORKFLOW_APP_ID and LIBRECODE_WORKFLOW_APP_PRIVATE_KEY"
+              [[ -n "${LIBRECODE_APP_CLIENT_ID}" && -n "${LIBRECODE_APP_PRIVATE_KEY}" ]] || {
+                echo "::error::librecode-app requires LIBRECODE_WORKFLOW_APP_CLIENT_ID and LIBRECODE_WORKFLOW_APP_PRIVATE_KEY"
                 exit 1
               }
               ;;
             github-app)
-              [[ -n "${CONSUMER_APP_ID}" && -n "${CONSUMER_APP_PRIVATE_KEY}" ]] || {
-                echo "::error::github-app requires WORKFLOW_SYNC_APP_ID and WORKFLOW_SYNC_APP_PRIVATE_KEY"
+              [[ -n "${CONSUMER_APP_CLIENT_ID}" && -n "${CONSUMER_APP_PRIVATE_KEY}" ]] || {
+                echo "::error::github-app requires WORKFLOW_SYNC_APP_CLIENT_ID and WORKFLOW_SYNC_APP_PRIVATE_KEY"
                 exit 1
               }
               ;;
@@ -94,7 +94,7 @@ jobs:
         id: librecode-app-token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          app-id: ${{ vars.LIBRECODE_WORKFLOW_APP_ID }}
+          client-id: ${{ vars.LIBRECODE_WORKFLOW_APP_CLIENT_ID }}
           private-key: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
           repositories: ${{ github.event.repository.name }}
@@ -107,7 +107,7 @@ jobs:
         id: consumer-app-token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          app-id: ${{ vars.WORKFLOW_SYNC_APP_ID }}
+          client-id: ${{ vars.WORKFLOW_SYNC_APP_CLIENT_ID }}
           private-key: ${{ secrets.WORKFLOW_SYNC_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
           repositories: ${{ github.event.repository.name }}