diff --git a/.github/workflows/frontend-cd.yml b/.github/workflows/frontend-cd.yml
index 6bf2c9e..358c3eb 100644
--- a/.github/workflows/frontend-cd.yml
+++ b/.github/workflows/frontend-cd.yml
@@ -31,6 +31,23 @@ jobs:
         env:
           CONVEX_DEPLOY_KEY: ${{ secrets.CONVEX_DEPLOY_KEY }}
 
+      - name: Set Convex GITHUB_TOKEN for skill imports
+        # skills.ts (repo skill import / SKILL.md fetch) calls the GitHub API
+        # from Convex egress — without a token it shares the 60/req/hr anon
+        # limit and fails. Set it on the SAME deployment CONVEX_DEPLOY_KEY
+        # targets (prod on main, staging otherwise), idempotently, so it rotates
+        # with the SKILLS_GITHUB_TOKEN secret. Fail-soft when the secret is unset.
+        run: |
+          cd packages/convex-backend
+          if [ -n "$SKILLS_GITHUB_TOKEN" ]; then
+            npx convex env set GITHUB_TOKEN "$SKILLS_GITHUB_TOKEN"
+          else
+            echo "SKILLS_GITHUB_TOKEN not set for this environment — skipping"
+          fi
+        env:
+          CONVEX_DEPLOY_KEY: ${{ secrets.CONVEX_DEPLOY_KEY }}
+          SKILLS_GITHUB_TOKEN: ${{ secrets.SKILLS_GITHUB_TOKEN }}
+
       - name: Determine environment
         id: env
         run: |