diff --git a/.github/workflows/sync-maybe-sure.yml b/.github/workflows/sync-maybe-sure.yml
index 30a92fe59..843b34788 100644
--- a/.github/workflows/sync-maybe-sure.yml
+++ b/.github/workflows/sync-maybe-sure.yml
@@ -6,7 +6,7 @@ on:
     - cron: '17 3 * * *'
 
 permissions:
-  contents: read
+  contents: write
 
 concurrency:
   group: sync-maybe-sure
@@ -14,27 +14,25 @@ concurrency:
 
 jobs:
   sync:
-    if: github.repository == 'we-promise/sure'
+    if: github.repository == 'we-promise/maybe-sure'
     runs-on: ubuntu-latest
     steps:
-      - name: Check out Sure
+      - name: Check out mirror
         uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Sync main to we-promise/maybe-sure
+      - name: Sync main from we-promise/sure
         shell: bash
         env:
-          MAYBE_SURE_SYNC_TOKEN: ${{ secrets.MAYBE_SURE_SYNC_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          if [[ -z "$MAYBE_SURE_SYNC_TOKEN" ]]; then
-            echo "MAYBE_SURE_SYNC_TOKEN is required to push to we-promise/maybe-sure" >&2
-            exit 1
-          fi
+          git remote add sure https://github.com/we-promise/sure.git
+          git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@github.com/we-promise/maybe-sure.git"
 
-          git remote add mirror "https://x-access-token:${MAYBE_SURE_SYNC_TOKEN}@github.com/we-promise/maybe-sure.git"
-          git fetch --no-tags mirror main
+          git fetch --no-tags sure main
+          git fetch --no-tags origin main
 
-          mirror_sha="$(git rev-parse refs/remotes/mirror/main)"
-          git push mirror HEAD:refs/heads/main --force-with-lease=refs/heads/main:"$mirror_sha"
+          mirror_sha="$(git rev-parse refs/remotes/origin/main)"
+          git push origin refs/remotes/sure/main:refs/heads/main --force-with-lease=refs/heads/main:"$mirror_sha"