diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a6f6525..6f5bce4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -640,5 +640,8 @@ jobs:
         CHANNEL: live
         # HMAC auth (reused from the emit job's secret).
         ROADMAP_CI_EVENT_HMAC_KEY: ${{ secrets.ROADMAP_CI_EVENT_HMAC_KEY }}
-        ROADMAP_PUBLISH_URL: ${{ secrets.ROADMAP_PUBLISH_URL }}
+        # API base URL — the publish endpoint path is appended by the
+        # script. Reuses the existing STARSTATS_API_URL secret rather
+        # than a separate per-endpoint URL secret.
+        STARSTATS_API_URL: ${{ secrets.STARSTATS_API_URL }}
       run: node scripts/auto-publish-changelog.mjs
diff --git a/scripts/auto-publish-changelog.mjs b/scripts/auto-publish-changelog.mjs
index 69f095d..83519c4 100644
--- a/scripts/auto-publish-changelog.mjs
+++ b/scripts/auto-publish-changelog.mjs
@@ -14,10 +14,13 @@
 // Required env vars:
 //   - ROADMAP_CI_EVENT_HMAC_KEY  Shared secret (raw bytes / UTF-8).
 //                                Same key as the emit endpoint.
-//   - ROADMAP_PUBLISH_URL        Full URL of the publish endpoint, e.g.
-//                                `https://api.starstats.app/v1/internal/roadmap/changelog/publish`.
-//                                Separated from `ROADMAP_EVENTS_URL` so
-//                                each endpoint can rotate independently.
+//   - STARSTATS_API_URL          Base URL of starstats-server, e.g.
+//                                `https://api.starstats.app`. The publish
+//                                endpoint path (`/v1/internal/roadmap/
+//                                changelog/publish`) is appended
+//                                automatically. Shared with the existing
+//                                admin-CLI publish path; one secret, one
+//                                source of truth for the API hostname.
 //   - ROADMAP_ITEM_SLUG          Slug to publish drafts for. Required.
 //
 // Optional:
@@ -55,8 +58,8 @@ const env = process.env;
 if (!env.ROADMAP_CI_EVENT_HMAC_KEY) {
   noop('ROADMAP_CI_EVENT_HMAC_KEY not set (pipeline not configured)');
 }
-if (!env.ROADMAP_PUBLISH_URL) {
-  noop('ROADMAP_PUBLISH_URL not set (pipeline not configured)');
+if (!env.STARSTATS_API_URL) {
+  noop('STARSTATS_API_URL not set (pipeline not configured)');
 }
 if (!env.ROADMAP_ITEM_SLUG) {
   noop('ROADMAP_ITEM_SLUG not set (no item to publish for)');
@@ -88,7 +91,10 @@ mac.update(`v1.${ts_ms}.`);
 mac.update(body);
 const sig = `v1=${mac.digest('hex')}`;
 
-const url = env.ROADMAP_PUBLISH_URL;
+// Compose the endpoint URL from the base. Trim trailing slashes so
+// `STARSTATS_API_URL=https://api.starstats.app/` and the bare form
+// both resolve identically.
+const url = `${env.STARSTATS_API_URL.replace(/\/+$/, "")}/v1/internal/roadmap/changelog/publish`;
 const headers = {
   'content-type': 'application/json',
   'X-StarStats-Timestamp': ts_ms,