diff --git a/.gitea/workflows/cicd-checks.yaml b/.gitea/workflows/cicd-checks.yaml
index c705da9..089accb 100644
--- a/.gitea/workflows/cicd-checks.yaml
+++ b/.gitea/workflows/cicd-checks.yaml
@@ -124,7 +124,8 @@ jobs:
     steps:
       - name: Dispatch tests workflow
         env:
-          DISPATCH_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }}
+          ACTIONS_TRIGGER_TOKEN: ${{ secrets.ACTIONS_TRIGGER_TOKEN }}
+          PACKAGE_ACCESS_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }}
           HEAD_SHA: ${{ needs.setup.outputs.head_sha }}
           REPO_FULL: ${{ github.repository }}
           HEAD_REF: ${{ github.head_ref }}
@@ -132,6 +133,8 @@ jobs:
         run: |
           set -e
 
+          DISPATCH_TOKEN="${ACTIONS_TRIGGER_TOKEN:-${PACKAGE_ACCESS_TOKEN:-}}"
+
           if [ -z "${DISPATCH_TOKEN}" ]; then
             echo "❌ Missing dispatch token. Set ACTIONS_TRIGGER_TOKEN (repo write scope) or ensure PACKAGE_ACCESS_TOKEN has Actions workflow-dispatch permissions."
             exit 1
@@ -160,7 +163,7 @@ jobs:
           DISPATCH_URL="${API_BASE}/repos/${REPO_OWNER}/${REPO_NAME}/actions/workflows/cicd-tests.yaml/dispatches"
           RESPONSE_FILE="/tmp/dispatch-response.txt"
           : > "${RESPONSE_FILE}"
-          HTTP_CODE=$(curl -sS -o "${RESPONSE_FILE}" -w "%{http_code}" -X POST \
+          HTTP_CODE=$(curl -sS --connect-timeout 5 --max-time 20 -o "${RESPONSE_FILE}" -w "%{http_code}" -X POST \
             -H "Authorization: token ${DISPATCH_TOKEN}" \
             -H "Content-Type: application/json" \
             "${DISPATCH_URL}" \
diff --git a/.gitea/workflows/cicd-start.yaml b/.gitea/workflows/cicd-start.yaml
index ba5c619..cdb6ad1 100644
--- a/.gitea/workflows/cicd-start.yaml
+++ b/.gitea/workflows/cicd-start.yaml
@@ -158,7 +158,8 @@ jobs:
       - name: Dispatch downstream workflow
         if: steps.base-decision.outcome == 'success' && steps.base-decision.outputs.head_sha != '' && steps.base-decision.outputs.base_needed != ''
         env:
-          DISPATCH_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }}
+          ACTIONS_TRIGGER_TOKEN: ${{ secrets.ACTIONS_TRIGGER_TOKEN }}
+          PACKAGE_ACCESS_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }}
           BASE_NEEDED: ${{ steps.base-decision.outputs.base_needed }}
           HEAD_SHA: ${{ steps.base-decision.outputs.head_sha }}
           BASE_HASH: ${{ steps.base-decision.outputs.base_hash }}
@@ -168,6 +169,8 @@ jobs:
         run: |
           set -e
 
+          DISPATCH_TOKEN="${ACTIONS_TRIGGER_TOKEN:-${PACKAGE_ACCESS_TOKEN:-}}"
+
           if [ -z "${DISPATCH_TOKEN}" ]; then
             echo "❌ Missing dispatch token. Set ACTIONS_TRIGGER_TOKEN (repo write scope) or ensure PACKAGE_ACCESS_TOKEN has Actions workflow-dispatch permissions."
             exit 1
@@ -216,7 +219,7 @@ jobs:
             RESPONSE_FILE="/tmp/dispatch-response.txt"
             : > "${RESPONSE_FILE}"
 
-            HTTP_CODE=$(curl -sS -o "${RESPONSE_FILE}" -w "%{http_code}" -X POST \
+            HTTP_CODE=$(curl -sS --connect-timeout 5 --max-time 20 -o "${RESPONSE_FILE}" -w "%{http_code}" -X POST \
               -H "Authorization: token ${DISPATCH_TOKEN}" \
               -H "Content-Type: application/json" \
               "${DISPATCH_URL}" \
diff --git a/.gitea/workflows/cicd.yml b/.gitea/workflows/cicd.yml
index 631d0b1..7d2d528 100644
--- a/.gitea/workflows/cicd.yml
+++ b/.gitea/workflows/cicd.yml
@@ -24,7 +24,8 @@ jobs:
 
       - name: Dispatch CICD Start workflow
         env:
-          DISPATCH_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }}
+          ACTIONS_TRIGGER_TOKEN: ${{ secrets.ACTIONS_TRIGGER_TOKEN }}
+          PACKAGE_ACCESS_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }}
           REPO_FULL: ${{ github.repository }}
           HEAD_REF: ${{ github.head_ref }}
           REF_NAME: ${{ github.ref_name }}
@@ -32,6 +33,8 @@ jobs:
         run: |
           set -e
 
+          DISPATCH_TOKEN="${ACTIONS_TRIGGER_TOKEN:-${PACKAGE_ACCESS_TOKEN:-}}"
+
           if [ -z "${DISPATCH_TOKEN}" ]; then
             echo "❌ Missing dispatch token. Set ACTIONS_TRIGGER_TOKEN (repo write scope) or ensure PACKAGE_ACCESS_TOKEN has Actions workflow-dispatch permissions."
             exit 1
@@ -60,7 +63,7 @@ jobs:
           DISPATCH_URL="${API_BASE}/repos/${REPO_OWNER}/${REPO_NAME}/actions/workflows/cicd-start.yaml/dispatches"
           RESPONSE_FILE="/tmp/dispatch-response.txt"
           : > "${RESPONSE_FILE}"
-          HTTP_CODE=$(curl -sS -o "${RESPONSE_FILE}" -w "%{http_code}" -X POST \
+          HTTP_CODE=$(curl -sS --connect-timeout 5 --max-time 20 -o "${RESPONSE_FILE}" -w "%{http_code}" -X POST \
             -H "Authorization: token ${DISPATCH_TOKEN}" \
             -H "Content-Type: application/json" \
             "${DISPATCH_URL}" \
diff --git a/.gitea/workflows/docker-build-base.yaml b/.gitea/workflows/docker-build-base.yaml
index 8e1c4f3..f947362 100644
--- a/.gitea/workflows/docker-build-base.yaml
+++ b/.gitea/workflows/docker-build-base.yaml
@@ -359,7 +359,8 @@ jobs:
     steps:
       - name: Dispatch main build workflow
         env:
-          DISPATCH_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }}
+          ACTIONS_TRIGGER_TOKEN: ${{ secrets.ACTIONS_TRIGGER_TOKEN }}
+          PACKAGE_ACCESS_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }}
           HEAD_SHA: ${{ needs.publish-base.outputs.head_sha }}
           BASE_HASH: ${{ needs.publish-base.outputs.base_hash }}
           REPO_FULL: ${{ github.repository }}
@@ -368,6 +369,8 @@ jobs:
         run: |
           set -e
 
+          DISPATCH_TOKEN="${ACTIONS_TRIGGER_TOKEN:-${PACKAGE_ACCESS_TOKEN:-}}"
+
           if [ -z "${DISPATCH_TOKEN}" ]; then
             echo "❌ Missing dispatch token. Set ACTIONS_TRIGGER_TOKEN (repo write scope) or ensure PACKAGE_ACCESS_TOKEN has Actions workflow-dispatch permissions."
             exit 1
@@ -398,7 +401,7 @@ jobs:
           DISPATCH_URL="${API_BASE}/repos/${REPO_OWNER}/${REPO_NAME}/actions/workflows/docker-build-main.yaml/dispatches"
           RESPONSE_FILE="/tmp/dispatch-response.txt"
           : > "${RESPONSE_FILE}"
-          HTTP_CODE=$(curl -sS -o "${RESPONSE_FILE}" -w "%{http_code}" -X POST \
+          HTTP_CODE=$(curl -sS --connect-timeout 5 --max-time 20 -o "${RESPONSE_FILE}" -w "%{http_code}" -X POST \
             -H "Authorization: token ${DISPATCH_TOKEN}" \
             -H "Content-Type: application/json" \
             "${DISPATCH_URL}" \
diff --git a/.gitea/workflows/docker-build-main.yaml b/.gitea/workflows/docker-build-main.yaml
index 1e3ec3f..a3ce5b6 100644
--- a/.gitea/workflows/docker-build-main.yaml
+++ b/.gitea/workflows/docker-build-main.yaml
@@ -180,7 +180,8 @@ jobs:
     steps:
       - name: Dispatch checks workflow
         env:
-          DISPATCH_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }}
+          ACTIONS_TRIGGER_TOKEN: ${{ secrets.ACTIONS_TRIGGER_TOKEN }}
+          PACKAGE_ACCESS_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }}
           HEAD_SHA: ${{ needs.build.outputs.head_sha }}
           REPO_FULL: ${{ github.repository }}
           HEAD_REF: ${{ github.head_ref }}
@@ -188,6 +189,8 @@ jobs:
         run: |
           set -e
 
+          DISPATCH_TOKEN="${ACTIONS_TRIGGER_TOKEN:-${PACKAGE_ACCESS_TOKEN:-}}"
+
           if [ -z "${DISPATCH_TOKEN}" ]; then
             echo "❌ Missing dispatch token. Set ACTIONS_TRIGGER_TOKEN (repo write scope) or ensure PACKAGE_ACCESS_TOKEN has Actions workflow-dispatch permissions."
             exit 1
@@ -216,7 +219,7 @@ jobs:
           DISPATCH_URL="${API_BASE}/repos/${REPO_OWNER}/${REPO_NAME}/actions/workflows/cicd-checks.yaml/dispatches"
           RESPONSE_FILE="/tmp/dispatch-response.txt"
           : > "${RESPONSE_FILE}"
-          HTTP_CODE=$(curl -sS -o "${RESPONSE_FILE}" -w "%{http_code}" -X POST \
+          HTTP_CODE=$(curl -sS --connect-timeout 5 --max-time 20 -o "${RESPONSE_FILE}" -w "%{http_code}" -X POST \
             -H "Authorization: token ${DISPATCH_TOKEN}" \
             -H "Content-Type: application/json" \
             "${DISPATCH_URL}" \