diff --git a/profiles/auto-upgrade.nix b/profiles/auto-upgrade.nix
index 6995070..b3c3ee0 100644
--- a/profiles/auto-upgrade.nix
+++ b/profiles/auto-upgrade.nix
@@ -18,6 +18,7 @@
   system.autoUpgrade.flags = [
     "-L" # print build logs
     "--no-write-lock-file" # no write new flakelock, as the in-store flake is read-only
+    "--option" "access-tokens" "" # don't risk an expired github token blocking the upgrade
     # fetch new inputs
     #"--recreate-lock-file" # update all
     #"--override-input" "nixpkgs-edge" # deprecated in nix 2.22, removed in lix 2.90
diff --git a/secrets/default.yaml b/secrets/default.yaml
index bdfd30a..498dfd0 100644
--- a/secrets/default.yaml
+++ b/secrets/default.yaml
@@ -1,7 +1,7 @@
 nix-community-builders-ssh-key-pub: ENC[AES256_GCM,data:WvjdlG/k+Hm8ZRaIc+6KzJvPIN6GXuepK9zwonOPbeST0IAcDU3OGxPW4as4ENZAaRdwd4ZnIUVhcTmgKlpGaBLhxTQgXYw1rIBgBP1gsSKSaGwE4/yzEIyN99E=,iv:H0ogbpBocFi+jgnKt3Jg9AkAV9YDQTbYAtejusQIBl8=,tag:XfC/1+3qd6J6LC4GKSMKxw==,type:str]
 nix-community-builders-ssh-key: ENC[AES256_GCM,data:9QNhqQS/6Cu7VMUoWEWkpDCMPu7df6dmreI3duzesonaW6F4W6vL+YLMMTvnnR6BpgmpGvHdvk1aDQnVmpneie6WRfbL4PbLARJviyh1Z/tLQhY9i/MMIADk8D+o4HXBnzLRIWLt319h5eUN1pvmGlJLrgfC0IZLRnPCQLjulIrlhDBlswkNgTrrS0VoRFSXk59JUm8/vWu2OQef2Q99Sug7wquiDZ/XJfqYYxYsGj9SeKiVpyxyuMkviuddee+IOr92KmT19UlekuXAjrYAGeRITrVj1lBSd8DSlBm1ww+0BRqzsAAFojM6N3TkyTjjoXRbVDzDcsMaoCQ7U4Ab9FVz7GdxeNKmeulZMUi4ORPlo4PQ6uDX6RjbWyLwiP33fl5VXMN9+YByVRUrpdtjkQF6jlylCBBRcWl/yOJbYcNg3zcWmJtdVu9t29SU45J2BcJ4Oi18oPf5P6QiU6dJiX1Ba8oR1QeLbFum724J+L5k64Rd84oLkxzVr5GLfXsp54sQ7FkrwEK9HWRfwN8F,iv:NTnnv0Hax/H7EoyHn0VRMG8sbb8tF23Ur2Ak4WYp8Bk=,tag:4hyGKetJ+I3zSqh1zOw/jg==,type:str]
-pbsbot-gh-token: ENC[AES256_GCM,data:iTY9T5OAlLjHNPIIkzERPGxhUWjGBurNlNsOhK9kGIs/pVMfAXVnbA==,iv:38oRE6dH4Bv/44VD8FqXZbQWCvggDd653jnUGMgOqyo=,tag:9p+jGrBf326q/6AP5rqM9w==,type:str]
-nix-access-tokens: ENC[AES256_GCM,data:pftDI6RAa/g/YqnvUO3QWtBTfZ2N1R8ce+hsu3/eBKRCgcBtu957bc68jteTvDTUbJOaW1g2+aAaF+/6cFnF5CNTv0V6qYhpft8=,iv:dSc70wJyhcaTV4fFxz67PxsXztk40k6TmIwo0ljbg1o=,tag:aw7dUnL9jAgst3nGguwm0w==,type:str]
+pbsbot-gh-token: ENC[AES256_GCM,data:iPTIei8KLfHKeGey08CfSsyuTufvxO4WHG9qE1TqmWHv5/vqW8YyGQ==,iv:JOKI1aFsnqPFkkkZuCmcIFZAbXe7kANt3QEuD+3GyWs=,tag:quwvq3FBiXE1GrzzdWVQww==,type:str]
+nix-access-tokens: ENC[AES256_GCM,data:L1vfP8nV+wX8jFlrIYEkmyeQh2M7sgHIu5RizaWv9EvzqCpLxFCbuxo/t0GlwQ8APotpdA3gVuHICJEvJ/mZMnyhr7NC+YDKzGc=,iv:V33lAnNtrOOttE4ujpB8X1TIrRfrjxaEyKYd/T68fpY=,tag:aqWKnEfugnyISUHHS8RHkg==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -107,8 +107,8 @@ sops:
             SklPV3NUSkxwSk1rWHg5N2tiN0xHeVkKhUqu6rVayVeGi00YMRXF1npO7j9oXySX
             rxVQgH6hYlLbeCIW4T6cP2eCbchWDi3Pear1DVknwEDa+DhHey7Bmg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-06-24T10:22:28Z"
-    mac: ENC[AES256_GCM,data:n8aXzUxE0MJST7eh+st8zbTJ7NtU4SxePn22C1vojVpkL2qAJpUsHqFAfaOINI6pknh28RAbglrpOa1LXwo7VnLm+qGL4LR7sq/yLBFcIeLZ0b1IDb/naDiDJigQOEgRLMUbHP8Y3wmGH9oLbp8yCyZ8kTTOd94tN+pmNMBfGeM=,iv:AnOtkrLsVppjyJhTDRhQB8Iw5J9jiGK6KIwn51JJ9l8=,tag:NZs1YBfVPZuNcgi0FcJkiQ==,type:str]
+    lastmodified: "2024-09-13T21:10:52Z"
+    mac: ENC[AES256_GCM,data:1SeFSFHPr7UPMJkrP4YxNsbp6bRLOPVtLHs/prj4d1t11qdpVUsYEuIVscfN8ZUvrshZwKFAcrJhVokMje1bMFbg2MxEvPh9j+3GX75K7dLfIW8pXc+5wpN+i/y61C+GFsrMLI1SBJT5xImiTBVwLlnMiGjcIXroDQg6NlDTp9w=,iv:WZagk2fQ1+OlkxZSZeJOIYtxR/hG43zWFDkGfHCGE3M=,tag:4Tigh9H0oCuI0b4y17dqLw==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.8.1
+    version: 3.9.0