diff --git a/.gitea/workflows/scripts/publish.sh b/.gitea/workflows/scripts/publish.sh
index fb2b265..29740fc 100755
--- a/.gitea/workflows/scripts/publish.sh
+++ b/.gitea/workflows/scripts/publish.sh
@@ -120,7 +120,13 @@ if [ "$MODE" != "pr" ]; then
         echo "MERGE_PR marker but this run is not on a PR thread — skipping merge"
       else
         echo "@qa autopilot: merging PR #$NUM (origin issue #${ISSNUM:-$NUM})"
-        mc=$(curl -sS -o /tmp/merge_resp.txt -w '%{http_code}' -X POST "${hdr[@]}" \
+        # Merge with AGENT_TOKEN (a PAT) — NOT the built-in Actions token — so the resulting push to
+        # main TRIGGERS downstream workflows (e.g. deploy). A merge made with the built-in GITEA_TOKEN
+        # does not fire new runs (loop-prevention), which silently skips the deploy. Fall back to the
+        # agent's own token only if AGENT_TOKEN isn't set (then the deploy would need a manual run).
+        mtok="${AGENT_TOKEN:-$TOK}"
+        mc=$(curl -sS -o /tmp/merge_resp.txt -w '%{http_code}' -X POST \
+              -H "Authorization: token $mtok" -H "Content-Type: application/json" \
               "$API/pulls/$NUM/merge" -d '{"Do":"merge"}')
         echo "merge -> HTTP $mc"; cat /tmp/merge_resp.txt 2>/dev/null || true
         case "$mc" in