diff --git a/.github/workflows/deploy-appstore-meta.yml b/.github/workflows/deploy-appstore-meta.yml
index 176aeae..3a87522 100644
--- a/.github/workflows/deploy-appstore-meta.yml
+++ b/.github/workflows/deploy-appstore-meta.yml
@@ -26,19 +26,19 @@ jobs:
       - name: Gate on credentials
         id: gate
         env:
-          SA_KEY: ${{ secrets.GCP_SA_KEY }}
+          SA_KEY: ${{ secrets.APPSTORE_META_GCP_SA_KEY }}
         run: |
           if [ -n "$SA_KEY" ]; then
             echo "enabled=true" >> "$GITHUB_OUTPUT"
           else
-            echo "GCP_SA_KEY is not configured; metadata deploy skipped."
+            echo "APPSTORE_META_GCP_SA_KEY is not configured; metadata deploy skipped."
             echo "enabled=false" >> "$GITHUB_OUTPUT"
           fi
 
       - uses: google-github-actions/auth@v2
         if: steps.gate.outputs.enabled == 'true'
         with:
-          credentials_json: ${{ secrets.GCP_SA_KEY }}
+          credentials_json: ${{ secrets.APPSTORE_META_GCP_SA_KEY }}
 
       - uses: google-github-actions/setup-gcloud@v2
         if: steps.gate.outputs.enabled == 'true'
diff --git a/deploy/appstore-meta/README.md b/deploy/appstore-meta/README.md
index 514a268..dedd7cd 100644
--- a/deploy/appstore-meta/README.md
+++ b/deploy/appstore-meta/README.md
@@ -48,6 +48,11 @@ curl -sI https://$HOST/v1/appstore/metadata | grep -i etag
 
 ## Update
 
+Repository deployments use a dedicated `APPSTORE_META_GCP_SA_KEY` secret.
+The service account must be able to read and SSH to the `appstore-meta`
+instance in this project, including IAP tunnel access. The general publishing
+VM credential is intentionally not reused across this project boundary.
+
 `startup.sh` re-clones and rebuilds on every boot:
 
 ```bash