diff --git a/.github/workflows/deploy-cloudflare.yml b/.github/workflows/deploy-cloudflare.yml
index 6ab28196..77978501 100644
--- a/.github/workflows/deploy-cloudflare.yml
+++ b/.github/workflows/deploy-cloudflare.yml
@@ -11,6 +11,10 @@ on:
         type: choice
         options: [site, harness-proof]
         default: site
+      rotate_registry_github_token:
+        description: Rotate the registry GitHub fallback token
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -94,6 +98,24 @@ jobs:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
 
+      - name: Rotate registry GitHub fallback token
+        if: github.event_name == 'workflow_dispatch' && inputs.rotate_registry_github_token
+        run: |
+          if [ -z "$REGISTRY_GITHUB_TOKEN" ]; then
+            echo 'If the replacement token is missing, set REGISTRY_GITHUB_TOKEN.' >&2
+            exit 1
+          fi
+          curl --fail --silent --show-error \
+            -H "Authorization: Bearer $REGISTRY_GITHUB_TOKEN" \
+            -H 'Accept: application/vnd.github+json' \
+            https://api.github.com/user \
+            --output "$RUNNER_TEMP/registry-token-owner.json"
+          printf '%s' "$REGISTRY_GITHUB_TOKEN" | pnpm exec wrangler secret put GITHUB_TOKEN --config wrangler.jsonc
+        env:
+          REGISTRY_GITHUB_TOKEN: ${{ secrets.REGISTRY_GITHUB_TOKEN }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+
       # Retries a transient Cloudflare API fault, such as code 10013. Any other
       # failure stops the job at once.
       - name: Deploy Artifact signer