diff --git a/docs/RUNBOOK-PhaseC.md b/docs/RUNBOOK-PhaseC.md
index def70c3..e6f21eb 100644
--- a/docs/RUNBOOK-PhaseC.md
+++ b/docs/RUNBOOK-PhaseC.md
@@ -621,11 +621,15 @@ while a downstream repo chased a snapshot-name bug that was fixed locally.
 Check before announcing any action change as done:
 
 ```bash
-sudo -u ci-runner /opt/ci/venv/bin/python tools/ci-action-published.py
+/opt/ci/venv/bin/python tools/ci-action-published.py
 # OK   — .gitea/ matches origin/main; CI runs what you see here.
 # FAIL — lists the drifted files, exit 1
 ```
 
+Run it as the user who commits, **not** under `sudo -u ci-runner`: it fetches,
+which needs write access to `.git`, and `.git/FETCH_HEAD` here belongs to the
+committing user.
+
 It catches both ways of being unpublished, committed-but-unpushed and
 edited-but-uncommitted, and fetches first so it compares against the server
 rather than a stale remote-tracking ref (`--no-fetch` to skip the network).
diff --git a/plans/cargo-dependency-cache.md b/plans/cargo-dependency-cache.md
index afa1c4c..e37589c 100644
--- a/plans/cargo-dependency-cache.md
+++ b/plans/cargo-dependency-cache.md
@@ -1154,7 +1154,7 @@ Windows runner or by reading the branch — but record which you did.
 git add .gitea/actions/local-ci-build/action.yml
 git commit -m "feat(action): cargo-cache input, cold on release tags"
 git push origin main
-sudo -u ci-runner /opt/ci/venv/bin/python tools/ci-action-published.py
+/opt/ci/venv/bin/python tools/ci-action-published.py
 ```
 
 Expected: `OK — .gitea/ matches origin/main`. Committing is not deploying for
@@ -1357,7 +1357,7 @@ is available as a per-workflow override.
 git add plans/cargo-dependency-cache-measurements.md docs/RUNBOOK-PhaseC.md TODO.md
 git commit -m "docs(cache): end-to-end numbers for the cargo dependency cache"
 git push origin main
-sudo -u ci-runner /opt/ci/venv/bin/python tools/ci-action-published.py
+/opt/ci/venv/bin/python tools/ci-action-published.py
 ```
 
 ---
diff --git a/tools/ci-action-published.py b/tools/ci-action-published.py
index 7e91a13..6e53678 100755
--- a/tools/ci-action-published.py
+++ b/tools/ci-action-published.py
@@ -11,8 +11,12 @@ That is not hypothetical: 59 commits sat unpushed for a day while a downstream
 repo debugged a snapshot-name bug we had already fixed locally (thread entry
 furyrs#14, 2026-07-22).
 
+Run it as the user who commits, not as ``ci-runner``: it fetches, which needs
+write access to ``.git``, and the question it answers is "does what I have
+match what is published".
+
 Usage:
-    sudo -u ci-runner /opt/ci/venv/bin/python tools/ci-action-published.py
+    /opt/ci/venv/bin/python tools/ci-action-published.py
     ... --ref main --no-fetch     # skip the network round-trip
 
 Exit 0 when the published `.gitea/` tree matches this working tree, 1 when it