diff --git a/.ciagent/config.json b/.ciagent/config.json
index 118b75e..cf9a3dc 100644
--- a/.ciagent/config.json
+++ b/.ciagent/config.json
@@ -72,7 +72,8 @@
     "sources": [".env", ".env.secrets", ".env.*"],
     "disallow": ["shell_env", "netrc", "keychain", "rc_files", "global_config"],
     "scopes": {
-      "gitea": "NOVA_GITEA_TOKEN",
+      "forge": "NOVA_FORGE_TOKEN",
+      "gitea": "NOVA_FORGE_TOKEN",
       "github": "GITHUB_TOKEN",
       "gitlab": "GITLAB_TOKEN",
       "openai": "OPENAI_API_KEY",
diff --git a/scripts/run_platform.sh b/scripts/run_platform.sh
index d508c81..dad0a01 100755
--- a/scripts/run_platform.sh
+++ b/scripts/run_platform.sh
@@ -389,11 +389,14 @@ if [ -z "${AWS_ACCESS_KEY_ID:-}" ] || [ -z "${AWS_SECRET_ACCESS_KEY:-}" ]; then
   # the shell env (SPEC §5.2 — the platform consumes NOVA_AWS_* as workflow
   # secrets, not shell env; config.security.bash_allowlist.blocked_env_vars
   # blocks NOVA_AWS_* from shell env — the v1.8 root-cause guard).
+  # The forge-token name is forge-agnostic (NOVA_FORGE_TOKEN, REQ-230);
+  # scripts/rotate_spike_key.sh (excluded from the sync scan) keeps a
+  # forge-specific backward-compat fallback for local runs.
   export AWS_ACCESS_KEY_ID="$NOVA_AWS_ACCESS_KEY_ID"
   export AWS_SECRET_ACCESS_KEY="$NOVA_AWS_SECRET_ACCESS_KEY"
   # Region: prefer the .env.secrets AWS_DEFAULT_REGION; default us-east-1.
   export AWS_DEFAULT_REGION="${AWS_DEFAULT_REGION:-us-east-1}"
-  unset NOVA_AWS_ACCESS_KEY_ID NOVA_AWS_SECRET_ACCESS_KEY NOVA_GITEA_TOKEN
+  unset NOVA_AWS_ACCESS_KEY_ID NOVA_AWS_SECRET_ACCESS_KEY NOVA_FORGE_TOKEN
 fi
 
 echo "=== Step 3c: Checkov on static code (fail-fast, before terraform plan) ==="
diff --git a/tests/test_deploy_workflow_env_input.py b/tests/test_deploy_workflow_env_input.py
index df4d694..d5c9538 100644
--- a/tests/test_deploy_workflow_env_input.py
+++ b/tests/test_deploy_workflow_env_input.py
@@ -113,5 +113,5 @@ def test_run_platform_sh_local_fallback_unsets_raw_nova_aws_vars():
     assert 'export AWS_ACCESS_KEY_ID="$NOVA_AWS_ACCESS_KEY_ID"' in text
     assert 'export AWS_SECRET_ACCESS_KEY="$NOVA_AWS_SECRET_ACCESS_KEY"' in text
     assert 'export AWS_DEFAULT_REGION="${AWS_DEFAULT_REGION:-us-east-1}"' in text
-    # ...then unsets the raw NOVA_AWS_* + the forge-token name.
-    assert "unset NOVA_AWS_ACCESS_KEY_ID NOVA_AWS_SECRET_ACCESS_KEY NOVA_GITEA_TOKEN" in text
+    # ...then unsets the raw NOVA_AWS_* + the forge-agnostic forge-token name.
+    assert "unset NOVA_AWS_ACCESS_KEY_ID NOVA_AWS_SECRET_ACCESS_KEY NOVA_FORGE_TOKEN" in text