diff --git a/.github/workflows/catalog.yml b/.github/workflows/catalog.yml
index 4374a1c..667501b 100644
--- a/.github/workflows/catalog.yml
+++ b/.github/workflows/catalog.yml
@@ -49,7 +49,8 @@ jobs:
       - run: pnpm install --frozen-lockfile
       - run: pnpm run update-stars
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # A GitHub token, optional: this server's own token means nothing to GitHub.
+          GITHUB_TOKEN: ${{ secrets.STARS_GITHUB_TOKEN }}
       - run: pnpm validate
       - name: Commit stars
         run: |
diff --git a/README.md b/README.md
index 1fa4beb..f6a1592 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # Ely GPUI Showcases
 
-Apps built with [Ely GPUI Components](https://github.com/ZacharyZhang-NY/Ely-GPUI-Components). The catalog feeds the Showcase page on the Ely site.
+Apps built with [Ely GPUI Components](https://git.zacharyzhang.com/ZacharyZhang-NY/Ely-GPUI-Components). The catalog feeds the Showcase page on the Ely site.
 
 ## Submit an app
 
@@ -59,7 +59,7 @@ Unknown fields fail validation.
 
 ## Stars
 
-On every push to `main` and each Monday, CI asks GitHub for each GitHub source's stars and commits any change. `starsUpdatedAt` moves only when the count does. `pnpm run update-stars` does the same locally with `GITHUB_TOKEN` set.
+On every push to `main` and each Monday, CI asks GitHub for each GitHub source's stars and commits any change. `starsUpdatedAt` moves only when the count does. It signs in with the `STARS_GITHUB_TOKEN` secret when set, a GitHub token, and asks anonymously otherwise. `pnpm run update-stars` does the same locally, `GITHUB_TOKEN` optional.
 
 ## How the site uses this
 
diff --git a/scripts/stars.mjs b/scripts/stars.mjs
index 1a3f82d..ee52230 100644
--- a/scripts/stars.mjs
+++ b/scripts/stars.mjs
@@ -20,13 +20,12 @@ export async function refresh(root, get, now) {
   return changed;
 }
 
-/** A repository's stars from GitHub's API. */
+/** A repository's stars from GitHub's API, signed in when GITHUB_TOKEN holds a GitHub token. */
 async function stargazers({ owner, repo }) {
   const token = process.env.GITHUB_TOKEN;
-  if (!token) throw new Error("stars: GITHUB_TOKEN is not set");
-  const res = await fetch(`https://api.github.com/repos/${owner}/${repo}`, {
-    headers: { accept: "application/vnd.github+json", authorization: `Bearer ${token}`, "x-github-api-version": "2022-11-28" },
-  });
+  const headers = { accept: "application/vnd.github+json", "x-github-api-version": "2022-11-28" };
+  if (token) headers.authorization = `Bearer ${token}`;
+  const res = await fetch(`https://api.github.com/repos/${owner}/${repo}`, { headers });
   if (!res.ok) throw new Error(`stars: ${owner}/${repo} answered ${res.status} ${await res.text()}`);
   return (await res.json()).stargazers_count;
 }