diff --git a/docs/dev/development.md b/docs/dev/development.md
index a16ba2f..4b5ce84 100644
--- a/docs/dev/development.md
+++ b/docs/dev/development.md
@@ -202,8 +202,10 @@ in the private repository alone: a push there starts nothing here. It always tes
 private repository, so a converter change that alters an expected output is two commits, the
 private one first. Before a release without suffix, `release.yml` runs the same steps as a job its
 release job waits for; a red harness ends the run before a release or a tag exists, and a
-`-beta.N` candidate skips it. The job reads the private repository with the per-job token; if
-that instance ever stops allowing this, the workflow's header names the 1Password fallback.
+`-beta.N` candidate skips it. The job reads the private repository with the per-job token, which
+works only because the private repository's own Actions settings grant `torben/chemenu` access;
+without that grant the checkout step fails with "Determining the default branch … not found",
+which reads like a missing repository rather than a missing permission.
 
 Three more workflows carry the live tests of the tracker adapters (Super Productivity, CalDAV):
 `ci.yml` runs the CalDAV half in a step of its own against Radicale as a process,