diff --git a/scripts/gitea_setup.sh b/scripts/gitea_setup.sh
index 34ebf4d..adcff18 100755
--- a/scripts/gitea_setup.sh
+++ b/scripts/gitea_setup.sh
@@ -72,6 +72,27 @@ print(json.dumps({
   esac
 }
 
+# set_repo_visibility REPO VISIBILITY (public|private)
+set_repo_visibility() {
+  local repo="$1"
+  local visibility="$2"
+  local body
+  body=$(python3 -c "
+import json
+is_private = ('${visibility}' == 'private')
+print(json.dumps({'private': is_private, 'visibility': '${visibility}'}))
+")
+  log "Setting ${repo} visibility to ${visibility}"
+  local status
+  status=$(curl -sS -o /tmp/setup_vis.json -w "%{http_code}" \
+    "${AUTH[@]}" -X PATCH -d "$body" \
+    "${API}/repos/${ORG}/${repo}")
+  case "$status" in
+    200) log "  ok (HTTP 200)" ;;
+    *) warn "set_repo_visibility ${repo} -> ${visibility} returned HTTP ${status} (continuing)"; cat /tmp/setup_vis.json >&2 || true ;;
+  esac
+}
+
 # file_exists REPO PATH -> 0 if the file already exists on the default branch
 file_exists_on_default() {
   local repo="$1"
@@ -190,6 +211,11 @@ else
   log "acdl-evidence already exists; skipping create"
 fi
 
+# Step 2b: make acdl-evidence public so the Phase 05 UI (index.html) can
+# fetch audit.json from a browser without exposing the API token (D-012
+# raw-URL approach). acdl-contracts stays private.
+set_repo_visibility acdl-evidence public
+
 # Step 3: push placeholder index.html to acdl-evidence
 create_placeholder_index acdl-evidence || exit 1
 
diff --git a/scripts/verify_phase01.sh b/scripts/verify_phase01.sh
index ef66ba5..425b464 100755
--- a/scripts/verify_phase01.sh
+++ b/scripts/verify_phase01.sh
@@ -12,20 +12,21 @@ set -euo pipefail
 GITEA_HOST="${GITEA_HOST:-https://git.cloudinit.dev}"
 ORG="continuous-intelligence"
 TOKEN="${ACDL_GITEA_TOKEN:-}"
-AUTH_HEADER=""
-if [ -n "$TOKEN" ]; then
-  AUTH_HEADER="-H \"Authorization: token ${TOKEN}\""
-fi
 
 fail_count=0
 note() { printf '  [%s] %s\n' "$1" "$2"; }
 pass() { note "PASS" "$1"; }
 fail() { note "FAIL" "$1"; fail_count=$((fail_count + 1)); }
+warn() { printf '  [WARN] %s\n' "$1" >&2; }
 
 echo "== Phase 01 verification =="
 echo "Host:  $GITEA_HOST"
 echo "Org:   $ORG"
-echo "Token: ${TOKEN:+<set, ${#TOKEN} chars>}${TOKEN:-<unset>}"
+if [ -n "$TOKEN" ]; then
+  echo "Token: <set, ${#TOKEN} chars>"
+else
+  echo "Token: <unset>"
+fi
 echo
 
 # --- Check 1: acdl-contracts repo exists ---
@@ -53,10 +54,17 @@ else
 fi
 
 # --- Check 3: acdl-evidence raw index.html returns 200 (Pages substitute per D-012/D-016) ---
+# acdl-evidence is public per gitea_setup.sh step 2b, so the raw URL should
+# work without auth. We also try with the auth header as a fallback so the
+# check does not spuriously fail if the repo visibility was reset.
 echo "-- Check 3: acdl-evidence raw index.html returns 200 --"
 index_url="${GITEA_HOST}/${ORG}/acdl-evidence/raw/branch/main/index.html"
-status=$(curl -sS -o /tmp/p01_index.html -w "%{http_code}" \
-  "${index_url}")
+status=$(curl -sS -o /tmp/p01_index.html -w "%{http_code}" "${index_url}")
+if [ "$status" != "200" ] && [ -n "$TOKEN" ]; then
+  warn "raw URL returned ${status} unauth; retrying with Authorization header"
+  status=$(curl -sS -o /tmp/p01_index.html -w "%{http_code}" \
+    -H "Authorization: token ${TOKEN}" "${index_url}")
+fi
 if [ "$status" = "200" ]; then
   body_size=$(wc -c < /tmp/p01_index.html)
   if grep -q "ACDL Evidence" /tmp/p01_index.html; then