diff --git a/.github/workflows/build_libzim_wasm.yml b/.github/workflows/build_libzim_wasm.yml
index 7705c87..9a21399 100644
--- a/.github/workflows/build_libzim_wasm.yml
+++ b/.github/workflows/build_libzim_wasm.yml
@@ -49,9 +49,8 @@ env:
   DISPATCH_TYPE: ${{ github.event.inputs.buildtype }}
   LIBZIM_VERSION: ${{ github.event.inputs.libzim_version }}
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  # Reverted to the repo-level secret: the org-level KIWIX_FILE_UPLOAD_SSH_KEY as currently stored
-  # fails to parse ("error in libcrypto: unsupported"), so no upload can authenticate with it.
-  # Switch back to secrets.KIWIX_FILE_UPLOAD_SSH_KEY once the org secret has been re-stored (#101).
+  # Repo-level by design: since the April 2026 infra change the download server uses a
+  # per-repository username and key, so there is deliberately no org-wide equivalent (#101).
   UPLOAD_SSH_KEY: ${{ secrets.JAVASCRIPTLIBZIM_FILE_UPLOAD_KEY }}
   BUILD_TYPE: ${{ github.event.inputs.buildtype }}
 
diff --git a/.github/workflows/upload_release_assets_to_kiwix.yml b/.github/workflows/upload_release_assets_to_kiwix.yml
index 3e49a9e..2779d4a 100644
--- a/.github/workflows/upload_release_assets_to_kiwix.yml
+++ b/.github/workflows/upload_release_assets_to_kiwix.yml
@@ -21,9 +21,8 @@ env:
   VERSION: ${{ github.event.release.tag_name }}
   DISPATCH_VERSION: ${{ github.event.inputs.version }}
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  # Reverted to the repo-level secret: the org-level KIWIX_FILE_UPLOAD_SSH_KEY as currently stored
-  # fails to parse ("error in libcrypto: unsupported"), so no upload can authenticate with it.
-  # Switch back to secrets.KIWIX_FILE_UPLOAD_SSH_KEY once the org secret has been re-stored (#101).
+  # Repo-level by design: since the April 2026 infra change the download server uses a
+  # per-repository username and key, so there is deliberately no org-wide equivalent (#101).
   UPLOAD_SSH_KEY: ${{ secrets.JAVASCRIPTLIBZIM_FILE_UPLOAD_KEY }}
 
 jobs:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 96b1918..4e639cd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,11 @@ WASM binary (`libzim.a`) from scratch, but from version 0.1, we have been using
 ASM applications. Release packages can be obtained from [Releases](https://github.com/openzim/javascript-libzim/releases) or from
 https://download.openzim.org/release/javascript-libzim/.
 
+## Unreleased
+
+* Revert the v0.95 migration to the org-level `KIWIX_FILE_UPLOAD_SSH_KEY` secret, since openZIM now authenticates each project with a per-repository username and key
+* Fail the release upload when `scp` does, instead of reporting every file as uploaded regardless of its exit code
+
 ## Javascript Libzim v0.95 (2026-08-06)
 
 * Build W/ASM from libzim 9.8.1 souce code (https://download.openzim.org/release/libzim/libzim_wasm-emscripten-9.8.1.tar.gz)
diff --git a/scripts/Upload-KiwixRelease.ps1 b/scripts/Upload-KiwixRelease.ps1
index 4e46bf5..f86b81a 100644
--- a/scripts/Upload-KiwixRelease.ps1
+++ b/scripts/Upload-KiwixRelease.ps1
@@ -1,6 +1,6 @@
 # A script to find release assets and upload them to the Kiwix release server.
-# If run locally, you must ensure that the KIWIX_FILE_UPLOAD_SSH_KEY secret to access the release server is available in
-# your File System, as scripts/upload_ssh_key (this is the file the workflow writes the secret to).
+# If run locally, you must ensure that the JAVASCRIPTLIBZIM_FILE_UPLOAD_KEY secret to access the release server is
+# available in your File System, as scripts/upload_ssh_key (the file the workflow writes the secret to).
 # You should also provide the tag version as input to this script, or set the $version variable to an existing release tag.
 
 param (