diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6116461..0e64632 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,9 @@
+## Unreleased (2026-11-11) — docs only: a repository address holds no credential (R-925, Part C of the clock/end-dates run)
+
+- `scripts/release-agent.sh` header: the tag push needs `GITEA_GIT_TOKEN` from the secret store (`sec run`). The origin
+  address of CC's clone on DooPlex held a login and a token until 2026-11-11; git now asks the helper
+  `felhom.eu/scripts/git-credential-sec.sh`. No code change, no version change, no release.
+
 ## v0.173.0 (2026-11-10) — R-1368 part 2: the self-update folder keeps what it needs and no more — RELEASED and VOUCHED 2026-11-10 (release-agent.sh from a clean clone of `776025c`; agent sha256 752b2727fb6043417ae5f342acbda52330521b21bb799fda90760b960feef7ea, bundle sha256 51ebc1f4c66d87918c87c035b4297c0e40e10ed31e3250c3837dfeaa0002e1c1)
 
 - **The defect (measured 2026-11-10, space list place H12).** `Execute` downloads each new agent to
diff --git a/scripts/release-agent.sh b/scripts/release-agent.sh
index d215129..7d32f0b 100755
--- a/scripts/release-agent.sh
+++ b/scripts/release-agent.sh
@@ -33,6 +33,9 @@
 # Env: GITEA_USER/GITEA_TOKEN (package write) — same credentials publish-agent.sh already takes.
 #      GITEA_BASE / GITEA_OWNER override the defaults.
 #      RELEASE_ALLOW_DIRTY=1 skips the clean-tree gate (for a rehearsal; never for a real release).
+#      GITEA_GIT_TOKEN — the tag push (`git push origin <tag>`) needs it since 2026-11-11: the address of a CC clone
+#      on DooPlex holds no credential, and git takes the token from the secret store through the helper
+#      felhom.eu/scripts/git-credential-sec.sh. Run the release as `sec run GITEA_GIT_TOKEN,... -- scripts/release-agent.sh <version>`.
 set -euo pipefail
 
 GITEA_BASE="${GITEA_BASE:-https://gitea.dooplex.hu}"