diff --git a/.github/workflows/zstd.yml b/.github/workflows/zstd.yml
index 228fa2ce..c5ffc170 100644
--- a/.github/workflows/zstd.yml
+++ b/.github/workflows/zstd.yml
@@ -1,15 +1,15 @@
 name: Zstd Archive Release
 
-# Grant the GITHUB_TOKEN write access so we can create releases & upload assets
+# Grant write access so we can create releases & upload assets
 permissions:
   contents: write
 
 on:
   push:
-    # Trigger on semver tags like v1.2.3
+    # Only run on semver-style tags like v1.2.3
     tags:
       - 'v*.*.*'
-  workflow_dispatch: # allow manual runs
+  workflow_dispatch: # (Optional) allows manual runs
 
 jobs:
   release:
@@ -37,12 +37,19 @@ jobs:
             "${{ steps.version.outputs.tag_name }}" \
           | zstd -o "${GITHUB_WORKSPACE}/${{ steps.version.outputs.tag_name }}.tar.zst"
 
+      - name: Debug upload context
+        run: |
+          echo "UPLOAD_URL: ${{ steps.create_release.outputs.upload_url }}"
+          echo "GITHUB_TOKEN length: ${#GITHUB_TOKEN}"
+        # ensure this uses your PAT
+        env:
+          GITHUB_TOKEN: ${{ secrets.PAT }}
+
       - name: Create GitHub Release
         id: create_release
         uses: actions/create-release@v1
         env:
-          # use your PAT stored in 'PAT' secret
-          GITHUB_TOKEN: ${{ secrets.PAT }}
+          GITHUB_TOKEN: ${{ secrets.PAT }} # your PAT secret with repo scope
         with:
           tag_name: ${{ steps.version.outputs.tag_name }}
           release_name: Release ${{ steps.version.outputs.tag_name }}
@@ -51,10 +58,10 @@ jobs:
 
       - name: Upload .tar.zst to GitHub Release
         uses: actions/upload-release-asset@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.PAT }} # same PAT here
         with:
           upload_url: ${{ steps.create_release.outputs.upload_url }}
           asset_path: ${{ github.workspace }}/${{ steps.version.outputs.tag_name }}.tar.zst
           asset_name: ${{ steps.version.outputs.tag_name }}.tar.zst
           asset_content_type: application/zstd
-          # pass the same PAT for authentication
-          token: ${{ secrets.PAT }}