diff --git a/.github/workflows/deploy-production.yml b/.github/workflows/deploy-production.yml
index 9eed5e98..29b2f4a2 100644
--- a/.github/workflows/deploy-production.yml
+++ b/.github/workflows/deploy-production.yml
@@ -105,13 +105,6 @@ jobs:
         if: ${{ github.event_name == 'workflow_dispatch' }}
         run: pnpm verify
 
-      - name: Validate authenticated MCP smoke credentials
-        env:
-          AGENT_PASTE_PRODUCTION_MCP_SMOKE_ACCESS_TOKEN: ${{ secrets.AGENT_PASTE_PRODUCTION_MCP_SMOKE_ACCESS_TOKEN }}
-        run: |
-          set -euo pipefail
-          test -n "$AGENT_PASTE_PRODUCTION_MCP_SMOKE_ACCESS_TOKEN"
-
       - name: Provision content capability DNS
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
@@ -168,11 +161,6 @@ jobs:
       - name: Smoke production (read-only, no credentials)
         run: pnpm smoke:prod:readonly
 
-      - name: Smoke production MCP (authenticated)
-        env:
-          AGENT_PASTE_PRODUCTION_MCP_SMOKE_ACCESS_TOKEN: ${{ secrets.AGENT_PASTE_PRODUCTION_MCP_SMOKE_ACCESS_TOKEN }}
-        run: pnpm smoke:mcp:production
-
       - name: Record Linear release
         uses: linear/linear-release-action@c0cb8354a362c24c6d3e0948f37fd66d07588e3f # v0.14.5
         with:
diff --git a/docs/adr/0097-mcp-private-principal-handoff.md b/docs/adr/0097-mcp-private-principal-handoff.md
index bc8ded42..99987bb8 100644
--- a/docs/adr/0097-mcp-private-principal-handoff.md
+++ b/docs/adr/0097-mcp-private-principal-handoff.md
@@ -45,9 +45,11 @@ delegating the credential or trusting an HTTP header.
 - `upload` no longer receives `WORKOS_API_KEY` or MCP issuer/JWKS configuration.
 - Scope changes and membership removal still take effect on the next tool call
   because downstream Workers resolve the current member row.
-- Production deploy smoke must include an authenticated MCP `whoami` and
-  `list_artifacts` call; a missing user OAuth smoke token fails before deployment.
-  WorkOS M2M tokens are not valid for this check because their subject is an
+- Amended 2026-09-15: production deployment uses credential-free smoke checks.
+  The original authenticated MCP deploy gate required manual replacement of
+  short-lived user OAuth tokens and was removed. Authenticated `whoami` and
+  `list_artifacts` checks remain operator-run with a current session token.
+  WorkOS M2M tokens are not valid for these checks because their subject is an
   application rather than a Workspace Member.
 - WorkOS redirect allowlists contain exact callback URIs, never wildcard hosts.
 - Each MCP publish/revision body and old/new edit string above 192 Ki characters
diff --git a/docs/ops/runbook-mcp-hosts.md b/docs/ops/runbook-mcp-hosts.md
index a9f19736..a3efdd83 100644
--- a/docs/ops/runbook-mcp-hosts.md
+++ b/docs/ops/runbook-mcp-hosts.md
@@ -246,10 +246,12 @@ pnpm smoke:mcp:preview
 pnpm smoke:mcp:production
 ```
 
-Production CI reads `AGENT_PASTE_PRODUCTION_MCP_SMOKE_ACCESS_TOKEN`. The token
-must belong to a current Workspace Member. WorkOS M2M credentials cannot be used
-for this smoke because client-credentials tokens identify an application and
-organization, not a user. Replace the CI secret when the user token expires.
+Production CI runs `pnpm smoke:prod:readonly`, including MCP metadata, OAuth
+challenges, and API-key rejection. Deployment does not require a stored user
+OAuth token. Authenticated MCP smoke is an operator check using a current
+session token belonging to a Workspace Member. WorkOS M2M credentials cannot
+be used for this check because client-credentials tokens identify an
+application and organization, not a user.
 
 Obtain the smoke token by completing a normal host OAuth flow against the target
 environment, then copy the access token from the host's token store or a
diff --git a/docs/ops/status/hosted-ops.md b/docs/ops/status/hosted-ops.md
index adbe4c11..9525cb2e 100644
--- a/docs/ops/status/hosted-ops.md
+++ b/docs/ops/status/hosted-ops.md
@@ -166,9 +166,10 @@ pnpm smoke:preview:ephemeral`
 8. Production deploy only with explicit Isaac approval:
    `pnpm migrate:production && pnpm deploy:production && pnpm smoke:production &&
 pnpm smoke:production:ephemeral && pnpm smoke:mcp:production`. The production
-   GitHub deploy workflow requires a production user OAuth smoke token before
-   any deploy step, then runs the authenticated MCP smoke after deployment. A
-   missing token or failed `whoami`/`list_artifacts` call fails the workflow.
+   GitHub deploy workflow runs `pnpm smoke:prod:readonly` after deployment,
+   including MCP metadata, OAuth challenges, and API-key rejection. It does not
+   require a stored user OAuth token. Authenticated MCP checks are operator-run
+   with a current session token.
 
 ## Hosted ephemeral publish smoke