diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 5267ba2106..7ac0e9bb48 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-bf2f74a4d8e34fab41682ca5a131be776b9c6a4d
+c3bc283f95d546c25998208dd46e9bd24641619a
diff --git a/docs/git-sync-gitlab-setup.md b/docs/git-sync-gitlab-setup.md
index cf38907afc..47bc700a65 100644
--- a/docs/git-sync-gitlab-setup.md
+++ b/docs/git-sync-gitlab-setup.md
@@ -19,9 +19,16 @@ is what you want for a credential the instance uses unattended.
 | Role | Developer to push deploy branches; **Maintainer** to also manage the webhook and open merge requests |
 | Expiry | Required for a group access token; a group service account PAT can be non-expiring on self-managed (see below) |
 
-The `api` scope is what makes the token rotatable, so Windmill can renew it
-before it expires. A `write_repository`-only token can still push, but Windmill
-cannot inspect or renew it and reports that in the workspace's git sync settings.
+`api` is a superset: it authorizes Git over HTTPS as well, so no separate
+`write_repository` is needed to clone and push, and it is also what makes the
+token rotatable so Windmill can renew it before it expires. A
+`write_repository`-only token can still push, but Windmill cannot inspect or
+renew it and reports that in the workspace's git sync settings.
+
+A group access token is renewed through GitLab's own self-rotation endpoint.
+GitLab issues one to a per-group bot user and keeps it as that user's personal
+access token, so the token rotates itself with no credential over the group
+involved, and Windmill never holds one.
 
 ## Connecting a repository