diff --git a/.gitea/workflows/handy-update.yml b/.gitea/workflows/handy-update.yml
index 89a9dcc..e2c1b68 100644
--- a/.gitea/workflows/handy-update.yml
+++ b/.gitea/workflows/handy-update.yml
@@ -85,7 +85,7 @@ jobs:
       - name: open pull request
         if: steps.update.outputs.updated == 'true'
         env:
-          GITEA_TOKEN: ${{ secrets.tea_token }}
+          GITEA_TOKEN: ${{ secrets.tea_token || secrets.TEA_TOKEN }}
         shell: bash
         run: |
           set -euo pipefail
@@ -93,11 +93,16 @@ jobs:
           api="https://gitea.unrail.xyz/api/v1/repos/thomas/nixos-config"
           branch="bot/handy-${{ steps.update.outputs.version }}"
 
+          if [ -z "${GITEA_TOKEN:-}" ]; then
+            echo "GITEA_TOKEN is empty (check repo secret tea_token/TEA_TOKEN)"
+            exit 1
+          fi
+
           echo "Checking for existing PRs..."
-          existing=$(curl -sS \
+          existing=$(curl -fsS \
             -H "Authorization: token ${GITEA_TOKEN}" \
             "${api}/pulls?state=open" \
-            | python -c 'import json,sys; d=json.load(sys.stdin); b="'"$branch"'"; print(next((str(pr["number"]) for pr in d if pr.get("head",{}).get("ref")==b), ""))')
+            | python -c 'import json,sys; d=json.load(sys.stdin); b="'"$branch"'"; print(next((str(pr["number"]) for pr in d if isinstance(pr,dict) and pr.get("head",{}).get("ref")==b), ""))')
 
           if [ -n "$existing" ]; then
             echo "PR already exists: #$existing"
diff --git a/.gitea/workflows/helium-update.yml b/.gitea/workflows/helium-update.yml
index 8e712fc..1a60ba7 100644
--- a/.gitea/workflows/helium-update.yml
+++ b/.gitea/workflows/helium-update.yml
@@ -86,7 +86,7 @@ jobs:
       - name: open pull request
         if: steps.update.outputs.updated == 'true'
         env:
-          GITEA_TOKEN: ${{ secrets.tea_token }}
+          GITEA_TOKEN: ${{ secrets.tea_token || secrets.TEA_TOKEN }}
         shell: bash
         run: |
           set -euo pipefail
@@ -94,6 +94,11 @@ jobs:
           api="https://gitea.unrail.xyz/api/v1/repos/thomas/nixos-config"
           branch="bot/helium-${{ steps.update.outputs.version }}"
 
+          if [ -z "${GITEA_TOKEN:-}" ]; then
+            echo "GITEA_TOKEN is empty (check repo secret tea_token/TEA_TOKEN)"
+            exit 1
+          fi
+
           # Skip if PR for this branch already exists
           existing=$(curl -fsS \
             -H "Authorization: token ${GITEA_TOKEN}" \
diff --git a/.gitea/workflows/zen-browser-update.yml b/.gitea/workflows/zen-browser-update.yml
index 49c0dbe..14749c4 100644
--- a/.gitea/workflows/zen-browser-update.yml
+++ b/.gitea/workflows/zen-browser-update.yml
@@ -85,7 +85,7 @@ jobs:
       - name: open pull request
         if: steps.update.outputs.updated == 'true'
         env:
-          GITEA_TOKEN: ${{ secrets.tea_token }}
+          GITEA_TOKEN: ${{ secrets.tea_token || secrets.TEA_TOKEN }}
         shell: bash
         run: |
           set -euo pipefail
@@ -93,10 +93,15 @@ jobs:
           api="https://gitea.unrail.xyz/api/v1/repos/thomas/nixos-config"
           branch="bot/zen-browser-${{ steps.update.outputs.version }}"
 
+          if [ -z "${GITEA_TOKEN:-}" ]; then
+            echo "GITEA_TOKEN is empty (check repo secret tea_token/TEA_TOKEN)"
+            exit 1
+          fi
+
           existing=$(curl -fsS \
             -H "Authorization: token ${GITEA_TOKEN}" \
             "${api}/pulls?state=open" \
-            | python -c 'import json,sys; d=json.load(sys.stdin); b="'"$branch"'"; print(next((str(pr["number"]) for pr in d if pr.get("head",{}).get("ref")==b), ""))')
+            | python -c 'import json,sys; d=json.load(sys.stdin); b="'"$branch"'"; print(next((str(pr["number"]) for pr in d if isinstance(pr,dict) and pr.get("head",{}).get("ref")==b), ""))')
 
           if [ -n "$existing" ]; then
             echo "PR already exists: #$existing"