diff --git a/.github/workflows/.ncmake-workflows.json b/.github/workflows/.ncmake-workflows.json
index f4dd108..ec0f42c 100644
--- a/.github/workflows/.ncmake-workflows.json
+++ b/.github/workflows/.ncmake-workflows.json
@@ -40,8 +40,8 @@
     "source": "nextcloud"
   },
   "workflow-updater.yml": {
-    "hash": "51db7ca85627ed5b4641677a577672df724936608152e3a36eef9f90da36e100",
-    "sha": "d81ef339dca007a84367431100725c64b7de2c74",
+    "hash": "d09a11fb854600d3856f21ed747560ed1e14ccc238b2320811a95802e8903264",
+    "sha": "80fdcb5df80688289a371c4d6358a301a37d6898",
     "source": "ncmake"
   }
 }
diff --git a/.github/workflows/workflow-updater.yml b/.github/workflows/workflow-updater.yml
index d81ef33..80fdcb5 100644
--- a/.github/workflows/workflow-updater.yml
+++ b/.github/workflows/workflow-updater.yml
@@ -60,6 +60,12 @@ jobs:
           persist-credentials: false
 
       - name: Refresh managed workflows from upstream
+        env:
+          # 'make dev-init' lists the ncmake modules through the GitHub API, and
+          # an anonymous call gets 60 requests per hour counted per source IP --
+          # shared by every job on a hosted runner, so it answers 403 every so
+          # often and fails the step. The app token is already minted above.
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           make dev-init
           make workflows-update