diff --git a/sweep.sh b/sweep.sh
index 4ec5821..dedb04c 100644
--- a/sweep.sh
+++ b/sweep.sh
@@ -7,16 +7,17 @@
 #
 # The ADMIN_TOKEN env var is shared with the main app (scheduler runs in the
 # same launch environment), so we use it to authenticate the call. Admin auth is
-# a header, never a URL token (security fix 2026-10-27). WEBHOOK_TOKEN is only a
-# fallback until this caller is fully migrated.
+# a header, never a URL token (security fix 2026-10-27). The WEBHOOK_TOKEN
+# fallback was removed when the cutover completed (ADMIN_TOKEN_LEGACY=0): the
+# legacy token now gets 403 on /admin/*, so falling back to it would turn
+# "ADMIN_TOKEN unset" into a confusing mid-run 403 instead of a clear abort.
 #
 # Uses Python (guaranteed present in the base image) rather than curl.
 
 set -e
 
-ADMIN_TOKEN="${ADMIN_TOKEN:-$WEBHOOK_TOKEN}"
 if [ -z "$ADMIN_TOKEN" ]; then
-  echo "sweep: neither ADMIN_TOKEN nor WEBHOOK_TOKEN is set; aborting" >&2
+  echo "sweep: ADMIN_TOKEN is not set; aborting" >&2
   exit 1
 fi