diff --git a/.env.example b/.env.example
index fc2483b..e984bc6 100644
--- a/.env.example
+++ b/.env.example
@@ -15,7 +15,7 @@ GITEA_REGISTRATION_TOKEN=your-registration-token
 # If set, API checks are performed as a bonus but do NOT affect pass/fail.
 # Required scopes: read:user, read:repository, read:admin (or just "admin")
 # Generate token at: Settings → Applications → Generate New Token
-# REPO_TOKEN=your-admin-api-token
+# CI_GITEA_TOKEN=your-admin-api-token
 
 # Integration test API retries (optional, default: 3).
 # Number of times to retry API checks waiting for runner to appear.
@@ -39,7 +39,7 @@ GITEA_REGISTRATION_TOKEN=your-registration-token
 
 # Gitea PyPI registry username (for private package access)
 # Used by PIP_INSTALL to configure PIP_EXTRA_INDEX_URL
-GITEA_REGISTRY_USERNAME=emil
+CI_GITEA_USERNAME=emil
 
 # devx configuration (GRM-specific overrides)
 # Task prefix for Vikunja task IDs
diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index dcd7319..7d17e3d 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -63,7 +63,8 @@ jobs:
           fetch-depth: 0
       - name: Set up environment
         env:
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
         run: make setup-image EXTRAS=ci,lint
       - name: Release dry-run validation
         env:
@@ -116,7 +117,8 @@ jobs:
       - name: Discover available runners
         id: discover
         env:
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
           MOLECULE_RUNNERS: ${{ vars.MOLECULE_RUNNERS }}
           PYTHONPATH: src
         run: |
@@ -163,7 +165,8 @@ jobs:
           python3 -m devx.molecule.molecule_ci_guard $TEST_PAIRS
         env:
           GITEA_URL: ${{ github.server_url }}
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
           RUN_ID: ${{ github.run_id }}
           JOB_NAME: ${{ github.job }}
           MATRIX_INDEX: ${{ matrix.runner-index }}
@@ -184,7 +187,8 @@ jobs:
         run: make setup-image
       - name: Run automated PR review
         env:
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
           PYTHONPATH: src
         run: |
           set -euo pipefail
@@ -216,12 +220,13 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          token: ${{ secrets.REPO_TOKEN }}
+          token: ${{ secrets.CI_GITEA_TOKEN }}
       - name: Set up environment
         run: make setup-image
       - name: Squash merge with task ID
         env:
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
           VIKUNJA_TOKEN: ${{ secrets.VIKUNJA_TOKEN }}
           PYTHONPATH: src
           DEVX_TASK_PREFIX: GRM
diff --git a/.gitea/workflows/post-merge.yml b/.gitea/workflows/post-merge.yml
index bb9fcbf..a0335c7 100644
--- a/.gitea/workflows/post-merge.yml
+++ b/.gitea/workflows/post-merge.yml
@@ -42,6 +42,9 @@ jobs:
         with:
           fetch-depth: 1
       - name: Set up environment
+        env:
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
         run: make setup-image
       - name: Check if this is a release commit
         id: check
@@ -62,6 +65,9 @@ jobs:
         with:
           fetch-depth: 1
       - name: Set up environment
+        env:
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
         run: make setup-image
       - name: Validate latest commit message
         env:
@@ -85,7 +91,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          token: ${{ secrets.REPO_TOKEN }}
+          token: ${{ secrets.CI_GITEA_TOKEN }}
       - name: Set up environment
         run: make setup-image EXTRAS=ci,lint
       - name: Configure git
@@ -106,7 +112,8 @@ jobs:
       - name: Notify on failure
         if: failure()
         env:
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
           PYTHONPATH: src
         run: |
           . .venv/bin/activate 2>/dev/null || true
@@ -131,7 +138,8 @@ jobs:
         run: make setup-image EXTRAS=ci,lint
       - name: Build and publish release
         env:
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
           PYTHONPATH: src
         run: |
           . .venv/bin/activate
@@ -142,7 +150,8 @@ jobs:
       - name: Notify on failure
         if: failure()
         env:
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
           PYTHONPATH: src
         run: |
           . .venv/bin/activate 2>/dev/null || true
@@ -167,7 +176,8 @@ jobs:
         run: make setup-image
       - name: Sync documentation to wiki
         env:
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
           PYTHONPATH: src
         run: |
           . .venv/bin/activate
@@ -175,7 +185,8 @@ jobs:
       - name: Notify on failure
         if: failure()
         env:
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
           PYTHONPATH: src
         run: |
           export PATH="$HOME/.local/bin:$PATH"
@@ -196,7 +207,7 @@ jobs:
         with:
           fetch-depth: 0
           ref: master
-          token: ${{ secrets.REPO_TOKEN }}
+          token: ${{ secrets.CI_GITEA_TOKEN }}
       - name: Fetch latest master
         run: |
           git fetch origin master
@@ -212,7 +223,8 @@ jobs:
       - name: Notify on failure
         if: failure()
         env:
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
           PYTHONPATH: src
         run: |
           export PATH="$HOME/.local/bin:$PATH"
@@ -246,7 +258,8 @@ jobs:
       - name: Notify on failure
         if: failure()
         env:
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
           PYTHONPATH: src
         run: |
           export PATH="$HOME/.local/bin:$PATH"
@@ -268,7 +281,8 @@ jobs:
         run: make setup-image
       - name: Ensure branch protection and labels
         env:
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
           PYTHONPATH: src
           DEVX_REPO_NAME: grm
           DEVX_REPO_OWNER: oblachno-oss
@@ -279,7 +293,8 @@ jobs:
       - name: Notify on failure
         if: failure()
         env:
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          REPO_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
           PYTHONPATH: src
         run: |
           export PATH="$HOME/.local/bin:$PATH"
diff --git a/AGENTS.md b/AGENTS.md
index a61d804..acb86e6 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -130,7 +130,7 @@ the **[manual]** items by reviewing the full diff
 
 Post review comments using `devx.ci.pr_review` (run as `python -m devx.ci.pr_review`):
 ```bash
-REPO_TOKEN=<token> python -m devx.ci.pr_review <pr_number> <owner/repo> \
+CI_GITEA_TOKEN=<token> python -m devx.ci.pr_review <pr_number> <owner/repo> \
   --event REQUEST_CHANGES \
   --body "Review summary" \
   --comments-json comments.json
@@ -143,7 +143,7 @@ Fix each comment one by one, commit, and push. Re-review until satisfied.
 Once all checklist items are verified and comments are addressed, post
 an approval review with `--checklist-confirmed` and `--checklist-categories`:
 ```bash
-REPO_TOKEN=<token> python -m devx.ci.pr_review <pr_number> <owner/repo> \
+CI_GITEA_TOKEN=<token> python -m devx.ci.pr_review <pr_number> <owner/repo> \
   --event APPROVE --checklist-confirmed \
   --checklist-categories 1,2,3,4,5,6,7,8,9,10,11,12,13 \
   --body "All 13 REVIEW_CHECKLIST.md categories verified. Architecture: <summary>. Security: <summary>. Tests: <summary>. Docs: <summary>."
@@ -309,7 +309,7 @@ The codebase enforces strict separation between the GRM tool and the devx packag
 
 ### tea CLI Integration
 
-The `tea` Gitea CLI tool is used for Gitea API interactions in devx. It is installed by `devx.tools.install_tools` and configured by `devx.tools.setup` (login profile from `.env` `REPO_TOKEN`).
+The `tea` Gitea CLI tool is used for Gitea API interactions in devx. It is installed by `devx.tools.install_tools` and configured by `devx.tools.setup` (login profile from `.env` `CI_GITEA_TOKEN`).
 
 **`devx.gitea_cli`** — Python wrapper around `tea` CLI with JSON output parsing:
 - `TeaCLI.create_issue()` — Create issues with labels
diff --git a/Makefile b/Makefile
index f787a2e..93953f8 100644
--- a/Makefile
+++ b/Makefile
@@ -68,17 +68,15 @@ setup-release: $(VENV)/bin/activate .env configure-gitea-pypi
 #        make setup-image EXTRAS=ci,lint (runtime + ci + lint deps)
 setup-image:
 	@if [ -d /opt/venv ]; then ln -sf /opt/venv .venv; . .venv/bin/activate; \
-		_PYPI_USER="$${GITEA_REGISTRY_USERNAME:-emil}"; \
-		if [ -n "$$REPO_TOKEN" ]; then export PIP_EXTRA_INDEX_URL="https://$$_PYPI_USER:$$REPO_TOKEN@git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple/"; fi; \
+		if [ -n "$$CI_GITEA_TOKEN" ]; then export PIP_EXTRA_INDEX_URL="https://$$CI_GITEA_USERNAME:$$CI_GITEA_TOKEN@git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple/"; fi; \
 		pip install -e .$(if $(EXTRAS),[$(EXTRAS)],); \
 	else echo "[setup-image] /opt/venv not found — falling back to setup-ci"; $(MAKE) setup-ci; fi
 
 # Helper: run pip install with Gitea registry configured
 # Usage: $(PIP_INSTALL) install -e '.[ci,lint]'
-PIP_INSTALL := if [ -z "$$REPO_TOKEN" ]; then . ./.env 2>/dev/null; fi; \
-	REPO_TOKEN="$${REPO_TOKEN:-$$GITEA_REGISTRY_TOKEN}"; \
-	_PYPI_USER="$${GITEA_REGISTRY_USERNAME:-emil}"; \
-	if [ -n "$$REPO_TOKEN" ]; then export PIP_EXTRA_INDEX_URL="https://$$_PYPI_USER:$$REPO_TOKEN@git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple/"; fi; \
+PIP_INSTALL := if [ -z "$$CI_GITEA_TOKEN" ]; then . ./.env 2>/dev/null; fi; \
+	CI_GITEA_TOKEN="$$CI_GITEA_TOKEN"; \
+	if [ -n "$$CI_GITEA_TOKEN" ]; then export PIP_EXTRA_INDEX_URL="https://$$CI_GITEA_USERNAME:$$CI_GITEA_TOKEN@git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple/"; fi; \
 	$(BIN)/pip
 
 $(VENV)/bin/activate:
@@ -147,10 +145,10 @@ workflow-dryrun: devx-workflow-dryrun
 workflow-check: devx-workflow-check
 
 configure-gitea-pypi:
-	@if [ -z "$$REPO_TOKEN" ]; then . ./.env 2>/dev/null; fi; \
-	REPO_TOKEN="$${REPO_TOKEN:-$$GITEA_REGISTRY_TOKEN}"; \
-	if [ -z "$$REPO_TOKEN" ]; then echo "[configure-gitea-pypi] REPO_TOKEN not set — skipping (devx must be on public PyPI)"; exit 0; fi; \
-	echo "[configure-gitea-pypi] Gitea PyPI registry configured (REPO_TOKEN present)."
+	@if [ -z "$$CI_GITEA_TOKEN" ]; then . ./.env 2>/dev/null; fi; \
+	CI_GITEA_TOKEN="$$CI_GITEA_TOKEN"; \
+	if [ -z "$$CI_GITEA_TOKEN" ]; then echo "[configure-gitea-pypi] CI_GITEA_TOKEN not set — skipping (devx must be on public PyPI)"; exit 0; fi; \
+	echo "[configure-gitea-pypi] Gitea PyPI registry configured (CI_GITEA_TOKEN present)."
 
 ansible-lint:
 	PATH="$(PWD)/$(BIN):$$PATH" $(BIN)/ansible-lint ansible/
diff --git a/README.md b/README.md
index ff774c4..ce2673b 100644
--- a/README.md
+++ b/README.md
@@ -169,7 +169,7 @@ GRM reads configuration from a `.env` file in the current directory (loaded auto
 
 | Variable | Default | Description |
 |----------|---------|-------------|
-| `REPO_TOKEN` | — | Gitea admin API token for optional post-install API verification |
+| `CI_GITEA_TOKEN` | — | Gitea admin API token for optional post-install API verification |
 | `GITEA_INTEGRATION_RETRIES` | `3` | Number of API check retries during integration test |
 | `GITEA_RUNNER_USER` | current login | Default SSH user (overrides `--user`) |
 | `GITEA_RUNNER_KEY` | — | Default SSH key path (overrides `--key`) |
diff --git a/TROUBLESHOOTING.md b/TROUBLESHOOTING.md
index d204546..7291565 100644
--- a/TROUBLESHOOTING.md
+++ b/TROUBLESHOOTING.md
@@ -9,7 +9,7 @@
 | Vikunja task not updated after merge | VIKUNJA_TOKEN expired or task ID missing from commit | Regenerate token; verify merge commit has `GRM-N:` prefix |
 | Post-merge can't find Vikunja task | Task not in project 6 or identifier mismatch | Verify task exists in Vikunja project 6 with correct identifier |
 | `make pytest-cov` fails | Coverage below 100% | Add tests for new code paths |
-| `devx.tools.configure_repo` fails | REPO_TOKEN missing or invalid | Set token with repo admin scope and re-run |
+| `devx.tools.configure_repo` fails | CI_GITEA_TOKEN missing or invalid | Set token with repo admin scope and re-run |
 | `configure_repo` sets wrong status checks | Stale `BRANCH_PROTECTION_CONFIG` | Updated to include `(pull_request)` suffix; re-run `configure_repo` |
 | Token visible in `ps aux` during install | Old version passed tokens via command line | Fixed: tokens now passed via temp file with `0600` permissions |
 | `remove-runner.yml` leaves lingering enabled | Old version didn't disable lingering | Fixed: now runs `loginctl disable-linger` and removes subuid/subgid |
diff --git a/docs/tech/ci-cd-workflow.md b/docs/tech/ci-cd-workflow.md
index 817113b..aebdce4 100644
--- a/docs/tech/ci-cd-workflow.md
+++ b/docs/tech/ci-cd-workflow.md
@@ -74,7 +74,7 @@ Review the full diff (`git diff master...HEAD`) focusing on:
 Post review comments using `devx.ci.pr_review`:
 
 ```bash
-REPO_TOKEN=<token> python -m devx.ci.pr_review <pr_number> <owner/repo> \
+CI_GITEA_TOKEN=<token> python -m devx.ci.pr_review <pr_number> <owner/repo> \
   --event REQUEST_CHANGES \
   --body "Review summary" \
   --comments-json comments.json
@@ -89,7 +89,7 @@ Fix each comment one by one, commit, and push. Re-review until satisfied.
 Once all comments are addressed:
 
 ```bash
-REPO_TOKEN=<token> python -m devx.ci.pr_review <pr_number> <owner/repo> \
+CI_GITEA_TOKEN=<token> python -m devx.ci.pr_review <pr_number> <owner/repo> \
   --event APPROVE \
   --body "All comments addressed. LGTM."
 ```
diff --git a/docs/tech/contributing.md b/docs/tech/contributing.md
index 704f1e4..2d85a12 100644
--- a/docs/tech/contributing.md
+++ b/docs/tech/contributing.md
@@ -137,7 +137,7 @@ Review the full diff (`git diff master...HEAD`) focusing on:
 Post review comments using `devx.ci.review_pr`:
 
 ```bash
-REPO_TOKEN=<token> python -m devx.ci.review_pr <pr_number> <owner/repo> \
+CI_GITEA_TOKEN=<token> python -m devx.ci.review_pr <pr_number> <owner/repo> \
   --event REQUEST_CHANGES \
   --body "Review summary" \
   --comments-json comments.json
@@ -152,7 +152,7 @@ Fix each comment one by one, commit, and push. Re-review until satisfied.
 Once all comments are addressed, post an approval review:
 
 ```bash
-REPO_TOKEN=<token> python -m devx.ci.review_pr <pr_number> <owner/repo> \
+CI_GITEA_TOKEN=<token> python -m devx.ci.review_pr <pr_number> <owner/repo> \
   --event APPROVE --checklist-confirmed \
   --checklist-categories 1,2,3,4,5,6,7,8,9,10,11,12,13 \
   --body "All 13 REVIEW_CHECKLIST.md categories verified."
diff --git a/docs/tech/development-setup.md b/docs/tech/development-setup.md
index e9ab639..4c6c205 100644
--- a/docs/tech/development-setup.md
+++ b/docs/tech/development-setup.md
@@ -108,7 +108,7 @@ cp .env.example .env
 
 #### Admin API token (optional)
 
-Set `REPO_TOKEN` to enable informational API checks during integration test. This is **optional** — the test primarily verifies the runner by checking:
+Set `CI_GITEA_TOKEN` to enable informational API checks during integration test. This is **optional** — the test primarily verifies the runner by checking:
 
 1. **`.runner` registration file** exists and contains valid JSON (proves successful registration)
 2. **Systemd user service** is active (proves daemon is polling for jobs)
diff --git a/docs/user/cli-commands.md b/docs/user/cli-commands.md
index faaa74d..ad0e1eb 100644
--- a/docs/user/cli-commands.md
+++ b/docs/user/cli-commands.md
@@ -51,7 +51,7 @@ grm install <host> [options]
 | `--name` | `-n` | hostname | Gitea Runner name |
 | `--token` | `-t` | `GITEA_REGISTRATION_TOKEN` env | Registration token |
 | `--url` | — | `GITEA_URL` env | Gitea URL |
-| `--admin-token` | `-a` | `REPO_TOKEN` env | Gitea admin API token for integration test |
+| `--admin-token` | `-a` | `CI_GITEA_TOKEN` env | Gitea admin API token for integration test |
 | `--integration-retries` | `-r` | `3` (`GITEA_INTEGRATION_RETRIES` env) | Integration test API retries |
 | `--labels` | `-l` | `GITEA_RUNNER_LABELS` env | Runner labels for Gitea Actions. Example: `docker:docker://alpine:latest` |
 | `--ask-become-pass/--no-ask-become-pass` | — | `--ask-become-pass` | Prompt for sudo password (default) or skip it |
@@ -294,7 +294,7 @@ All CLI options can be set via environment variables (loaded from `.env` via pyt
 |----------|---------|-------------|
 | `GITEA_URL` | `install`, `disable`, `remove` | Gitea instance URL |
 | `GITEA_REGISTRATION_TOKEN` | `install`, `disable`, `remove` | Runner registration token |
-| `REPO_TOKEN` | `install` | Admin API token for integration test |
+| `CI_GITEA_TOKEN` | `install` | Admin API token for integration test |
 | `GITEA_INTEGRATION_RETRIES` | `install` | API check retries (default: 3) |
 | `GITEA_RUNNER_USER` | `install`, `update` | Default SSH user |
 | `GITEA_RUNNER_KEY` | `install`, `update` | Default SSH key path |
diff --git a/docs/user/faq.md b/docs/user/faq.md
index 204b0c9..e2add74 100644
--- a/docs/user/faq.md
+++ b/docs/user/faq.md
@@ -10,9 +10,9 @@ There are three levels of registration tokens, depending on which repositories t
 
 Set the token as `GITEA_REGISTRATION_TOKEN` in your `.env` file or pass it via `--token` on the command line.
 
-### What is the REPO_TOKEN and do I need it?
+### What is the CI_GITEA_TOKEN and do I need it?
 
-`REPO_TOKEN` is a Gitea admin API token used for optional post-install verification. When set, GRM queries the Gitea API after installation to confirm the runner appears in the runner list. This is purely informational — the integration test passes/fails based on the `.runner` file and systemd service, not the API check.
+`CI_GITEA_TOKEN` is a Gitea admin API token used for optional post-install verification. When set, GRM queries the Gitea API after installation to confirm the runner appears in the runner list. This is purely informational — the integration test passes/fails based on the `.runner` file and systemd service, not the API check.
 
 To generate one: Settings → Applications → Generate New Token, with the `admin` scope (or at minimum `read:user`, `read:repository`, `read:admin`).
 
diff --git a/docs/user/getting-started.md b/docs/user/getting-started.md
index 8b70885..9f08561 100644
--- a/docs/user/getting-started.md
+++ b/docs/user/getting-started.md
@@ -84,7 +84,7 @@ GITEA_URL=https://git.example.com
 GITEA_REGISTRATION_TOKEN=GRxxxxxxxxxxxxxxxxxx
 
 # Admin API token from Step 2 (optional)
-REPO_TOKEN=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+CI_GITEA_TOKEN=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
 ```
 
 ### Environment Variables Reference
@@ -93,7 +93,7 @@ REPO_TOKEN=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
 |----------|----------|---------|-------------|
 | `GITEA_URL` | Yes | — | Gitea instance URL (e.g., `https://git.example.com`) |
 | `GITEA_REGISTRATION_TOKEN` | Yes | — | Runner registration token from Gitea admin panel |
-| `REPO_TOKEN` | No | — | Admin API token for post-install verification |
+| `CI_GITEA_TOKEN` | No | — | Admin API token for post-install verification |
 | `GITEA_INTEGRATION_RETRIES` | No | `3` | API check retries (default: 3) |
 | `GITEA_RUNNER_USER` | No | current login | Default SSH user (overrides `--user`) |
 | `GITEA_RUNNER_KEY` | No | — | Default SSH key path (overrides `--key`) |
@@ -150,7 +150,7 @@ The installer performs an automated integration test that verifies:
 
 You can also check the Gitea UI under **Actions → Runners** to confirm the runner appears as **Online**.
 
-Optional: If `REPO_TOKEN` is set, the installer will also query the Gitea API and report whether the runner appears in the admin or repo runners list. This is purely informational.
+Optional: If `CI_GITEA_TOKEN` is set, the installer will also query the Gitea API and report whether the runner appears in the admin or repo runners list. This is purely informational.
 
 ### Check runner status via CLI
 
diff --git a/docs/user/troubleshooting.md b/docs/user/troubleshooting.md
index 7262059..fae651e 100644
--- a/docs/user/troubleshooting.md
+++ b/docs/user/troubleshooting.md
@@ -98,7 +98,7 @@ The test checks two things:
 
 ### API verification shows error status
 
-If `REPO_TOKEN` is set, the integration test queries the Gitea API. If the API returns `401` or `403`, the token does not have sufficient permissions. This is **informational only** and does not affect pass/fail. The test passes as long as the `.runner` file exists and the systemd service is active.
+If `CI_GITEA_TOKEN` is set, the integration test queries the Gitea API. If the API returns `401` or `403`, the token does not have sufficient permissions. This is **informational only** and does not affect pass/fail. The test passes as long as the `.runner` file exists and the systemd service is active.
 
 ## Logging and Diagnostics
 
@@ -191,7 +191,7 @@ If Docker is not installed, install it via your package manager or [Docker's off
 | Vikunja task not updated after merge | VIKUNJA_TOKEN expired or task ID missing from commit | Regenerate token; verify merge commit has `GRM-N:` prefix |
 | Post-merge can't find Vikunja task | Task not in project 6 or identifier mismatch | Verify task exists in Vikunja project 6 with correct identifier |
 | `make pytest-cov` fails | Coverage below 100% | Add tests for new code paths |
-| `devx.tools.configure_repo` fails | REPO_TOKEN missing or invalid | Set token with repo admin scope and re-run |
+| `devx.tools.configure_repo` fails | CI_GITEA_TOKEN missing or invalid | Set token with repo admin scope and re-run |
 | `configure_repo` sets wrong status checks | Stale `BRANCH_PROTECTION_CONFIG` | Updated to include `(pull_request)` suffix; re-run `configure_repo` |
 | Token visible in `ps aux` during install | Old version passed tokens via command line | Fixed: tokens now passed via temp file with `0600` permissions |
 | `remove-runner.yml` leaves lingering enabled | Old version didn't disable lingering | Fixed: now runs `loginctl disable-linger` and removes subuid/subgid |
diff --git a/src/gitea_runner_manager/cli.py b/src/gitea_runner_manager/cli.py
index 85a41a2..6da8a68 100644
--- a/src/gitea_runner_manager/cli.py
+++ b/src/gitea_runner_manager/cli.py
@@ -77,8 +77,8 @@ def cli() -> None:
 @click.option(
     "--admin-token",
     "-a",
-    default=lambda: os.getenv("REPO_TOKEN"),
-    help=_("Gitea admin API token for integration test (env: REPO_TOKEN)"),
+    default=lambda: os.getenv("CI_GITEA_TOKEN"),
+    help=_("Gitea admin API token for integration test (env: CI_GITEA_TOKEN)"),
 )
 @click.option(
     "--integration-retries",
diff --git a/src/gitea_runner_manager/translations.json b/src/gitea_runner_manager/translations.json
index 1a626b2..e5c0c70 100644
--- a/src/gitea_runner_manager/translations.json
+++ b/src/gitea_runner_manager/translations.json
@@ -159,13 +159,13 @@
     "ru": "URL Gitea (env: GITEA_URL)",
     "zh": "Gitea URL（环境变量: GITEA_URL）"
   },
-  "Gitea admin API token for integration test (env: REPO_TOKEN)": {
-    "bg": "Gitea admin API токен за интеграционен тест (env: REPO_TOKEN)",
-    "de": "Gitea-Admin-API-Token für Integrationstest (env: REPO_TOKEN)",
-    "en": "Gitea admin API token for integration test (env: REPO_TOKEN)",
-    "pl": "Token API administratora Gitea do testów integracyjnych (env: REPO_TOKEN)",
-    "ru": "Токен админ API Gitea для интеграционного теста (env: REPO_TOKEN)",
-    "zh": "Gitea 管理员 API 令牌，用于集成测试（环境变量: REPO_TOKEN）"
+  "Gitea admin API token for integration test (env: CI_GITEA_TOKEN)": {
+    "bg": "Gitea admin API токен за интеграционен тест (env: CI_GITEA_TOKEN)",
+    "de": "Gitea-Admin-API-Token für Integrationstest (env: CI_GITEA_TOKEN)",
+    "en": "Gitea admin API token for integration test (env: CI_GITEA_TOKEN)",
+    "pl": "Token API administratora Gitea do testów integracyjnych (env: CI_GITEA_TOKEN)",
+    "ru": "Токен админ API Gitea для интеграционного теста (env: CI_GITEA_TOKEN)",
+    "zh": "Gitea 管理员 API 令牌，用于集成测试（环境变量: CI_GITEA_TOKEN）"
   },
   "HOST": {
     "bg": "ХОСТ",
diff --git a/tests/unit/test_cli.py b/tests/unit/test_cli.py
index 51b5cbb..5a09500 100644
--- a/tests/unit/test_cli.py
+++ b/tests/unit/test_cli.py
@@ -7,6 +7,8 @@ from click.testing import CliRunner
 from gitea_runner_manager import __version__
 from gitea_runner_manager.cli import cli
 
+_TEST_ENV = {"GITEA_URL": "https://git.example.com", "CI_GITEA_TOKEN": "", "GITEA_RUNNER_LABELS": ""}
+
 
 class TestCLI:
     def test_cli_version(self) -> None:
@@ -20,7 +22,7 @@ class TestCLI:
         mock_manager = MagicMock()
         mock_manager_class.return_value = mock_manager
 
-        runner = CliRunner(env={"GITEA_URL": "https://git.example.com", "REPO_TOKEN": "", "GITEA_RUNNER_LABELS": ""})
+        runner = CliRunner(env=_TEST_ENV)
         result = runner.invoke(cli, ["install", "host1", "--user", "ubuntu", "--token", "tok"])
         assert result.exit_code == 0
         mock_manager.install.assert_called_once_with(
@@ -41,7 +43,7 @@ class TestCLI:
         mock_manager = MagicMock()
         mock_manager_class.return_value = mock_manager
 
-        runner = CliRunner(env={"GITEA_URL": "https://git.example.com", "REPO_TOKEN": "", "GITEA_RUNNER_LABELS": ""})
+        runner = CliRunner(env=_TEST_ENV)
         result = runner.invoke(cli, ["install", "host1", "--user", "ubuntu", "--token", "tok", "--no-ask-become-pass"])
         assert result.exit_code == 0
         mock_manager.install.assert_called_once_with(
@@ -115,7 +117,7 @@ class TestCLI:
         mock_manager = MagicMock()
         mock_manager_class.return_value = mock_manager
 
-        runner = CliRunner(env={"GITEA_URL": "https://git.example.com", "REPO_TOKEN": "", "GITEA_RUNNER_LABELS": ""})
+        runner = CliRunner(env=_TEST_ENV)
         result = runner.invoke(
             cli,
             [
@@ -150,7 +152,7 @@ class TestCLI:
         mock_manager = MagicMock()
         mock_manager_class.return_value = mock_manager
 
-        runner = CliRunner(env={"GITEA_URL": "https://git.example.com", "REPO_TOKEN": "", "GITEA_RUNNER_LABELS": ""})
+        runner = CliRunner(env=_TEST_ENV)
         result = runner.invoke(cli, ["install", "host1", "--user", "ubuntu", "--token", "tok", "--ask-become-pass"])
         assert result.exit_code == 0
         mock_manager.install.assert_called_once_with(