diff --git a/.github/SECURITY-HARDENING.md b/.github/SECURITY-HARDENING.md
index 060df458e0..9922676eba 100644
--- a/.github/SECURITY-HARDENING.md
+++ b/.github/SECURITY-HARDENING.md
@@ -62,7 +62,6 @@ Configure these GitHub Apps before the first release after this checklist lands:
 | Purpose                               | Repository access                                                            | Required permissions                  | Variables and secrets                                                  |
 | ------------------------------------- | ---------------------------------------------------------------------------- | ------------------------------------- | ---------------------------------------------------------------------- |
 | Release artifacts and deploy dispatch | `veryfront`, `veryfront-server`, `veryfront-job-runner`, `veryfront-sandbox` | Contents: write                       | `VERYFRONT_RELEASE_APP_CLIENT_ID`, `VERYFRONT_RELEASE_APP_PRIVATE_KEY` |
-| Docs sync                             | `veryfront-docs`                                                             | Contents: write                       | `VERYFRONT_DOCS_APP_CLIENT_ID`, `VERYFRONT_DOCS_APP_PRIVATE_KEY`       |
 | Homebrew tap                          | `homebrew-tap`                                                               | Contents: write, Pull requests: write | `HOMEBREW_TAP_APP_CLIENT_ID`, `HOMEBREW_TAP_APP_PRIVATE_KEY`           |
 
 The release App private key must only be used on fresh public-upload and downstream-dispatch runners. These runners must never check out repository code, invoke local actions, run package code, or execute downloaded assets. npm publishers and SBOM preparation pass inert assets through a SHA-addressed artifact and never receive the release App identity or key. Limiting the repositories on one installation token does not limit what its private key can mint.
diff --git a/.github/workflows/sync-docs.yml b/.github/workflows/sync-docs.yml
deleted file mode 100644
index f20e90c913..0000000000
--- a/.github/workflows/sync-docs.yml
+++ /dev/null
@@ -1,41 +0,0 @@
-name: Sync Docs
-
-on:
-  push:
-    branches: [main]
-    paths:
-      - "src/**/index.ts"
-      - "src/**/types.ts"
-      - "scripts/docs/**"
-      - "deno.json"
-      - "docs/getting-started/**"
-      - "docs/guides/**"
-      - "docs/concepts/**"
-      - "docs/api-reference/**"
-      - "docs/integrations.md"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  dispatch:
-    runs-on: ubuntu-latest
-    environment: production
-    steps:
-      - name: Create docs GitHub App token
-        id: docs-app-token
-        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510  # v3.3.0
-        with:
-          client-id: ${{ vars.VERYFRONT_DOCS_APP_CLIENT_ID }}
-          private-key: ${{ secrets.VERYFRONT_DOCS_APP_PRIVATE_KEY }}
-          owner: veryfront
-          repositories: veryfront-docs
-          permission-contents: write
-
-      - uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697  # v4.0.1
-        with:
-          token: ${{ steps.docs-app-token.outputs.token }}
-          repository: veryfront/veryfront-docs
-          event-type: docs-update
-          client-payload: '{"sha": "${{ github.sha }}"}'
diff --git a/src/security/repository-hardening.test.ts b/src/security/repository-hardening.test.ts
index 68cc953203..69f5646cfa 100644
--- a/src/security/repository-hardening.test.ts
+++ b/src/security/repository-hardening.test.ts
@@ -144,7 +144,6 @@ describe("repository hardening", () => {
         "External fork pull requests",
         "GitHub App release credentials",
         "VERYFRONT_RELEASE_APP_CLIENT_ID",
-        "VERYFRONT_DOCS_APP_CLIENT_ID",
         "HOMEBREW_TAP_APP_CLIENT_ID",
         "GH_PAT_VERYFRONT",
         "GH_PAT_HOMEBREW_TAP",
@@ -270,38 +269,32 @@ describe("repository hardening", () => {
   });
 
   it("uses scoped GitHub App tokens instead of release PATs", async () => {
-    const releaseWorkflow = await readText(".github/workflows/cicd.yml");
-    const docsWorkflow = await readText(".github/workflows/sync-docs.yml");
-    const workflows = `${releaseWorkflow}\n${docsWorkflow}`;
+    const workflow = await readText(".github/workflows/cicd.yml");
 
-    assertEquals(workflows.includes("GH_PAT_"), false);
-    assertEquals(workflows.includes("HOMEBREW_TAP_PAT"), false);
+    assertEquals(workflow.includes("GH_PAT_"), false);
+    assertEquals(workflow.includes("HOMEBREW_TAP_PAT"), false);
 
     for (
       const required of [
         CREATE_APP_TOKEN_ACTION,
         "client-id: ${{ vars.VERYFRONT_RELEASE_APP_CLIENT_ID }}",
         "private-key: ${{ secrets.VERYFRONT_RELEASE_APP_PRIVATE_KEY }}",
-        "client-id: ${{ vars.VERYFRONT_DOCS_APP_CLIENT_ID }}",
-        "private-key: ${{ secrets.VERYFRONT_DOCS_APP_PRIVATE_KEY }}",
         "client-id: ${{ vars.HOMEBREW_TAP_APP_CLIENT_ID }}",
         "private-key: ${{ secrets.HOMEBREW_TAP_APP_PRIVATE_KEY }}",
         "repositories: |",
         "veryfront-server",
         "veryfront-job-runner",
         "veryfront-sandbox",
-        "veryfront-docs",
         "homebrew-tap",
         "permission-contents: write",
         "permission-pull-requests: write",
         "steps.release-app-token.outputs.token",
-        "steps.docs-app-token.outputs.token",
         "steps.homebrew-app-token.outputs.token",
       ]
     ) {
       assert(
-        workflows.includes(required),
-        `expected workflows to use ${required}`,
+        workflow.includes(required),
+        `expected workflow to use ${required}`,
       );
     }
   });