diff --git a/.forgejo/workflows/pipeline.yml b/.forgejo/workflows/pipeline.yml
index 8cfc876..3aa2dc7 100644
--- a/.forgejo/workflows/pipeline.yml
+++ b/.forgejo/workflows/pipeline.yml
@@ -201,7 +201,7 @@ jobs:
         run: rm -rf .ci
 
   mirror:
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && vars.MIRROR_ENABLED == 'true'
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     needs: deploy
     runs-on: docker
     steps:
diff --git a/docs/ci-cd.md b/docs/ci-cd.md
index 7d3bb5d..7f47e09 100644
--- a/docs/ci-cd.md
+++ b/docs/ci-cd.md
@@ -24,9 +24,9 @@ Forgejo UI:
 - `MIRROR_SSH_KEY`: private half of a write-enabled deploy key for
   `git@github.com:Fi3w0/Nereus.git`.
 
-After registering that deploy key, set the Forgejo Actions repository variable
-`MIRROR_ENABLED` to `true`. The mirror job stays skipped until both sides
-are configured, so an absent GitHub credential cannot break production deploys.
+After registering that deploy key, every successful production deployment
+pushes `main` to GitHub automatically. An absent or invalid mirror credential
+fails only the final mirror job, after production has already deployed.
 
 Before the first sealed deployment, a cluster administrator must bootstrap the
 deployer's namespaced SealedSecret permission: