diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ebae075ba..0e6c09cbc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,9 +10,9 @@ on:
   push:
     branches: [main]
   merge_group:
-  # sync-upstream.yml opens the sync PR with GITHUB_TOKEN, which suppresses
-  # pull_request events. sync-upstream dispatches CI explicitly on the sync
-  # branch head so required checks appear on the PR.
+  # The overlay upstream_sync workflow opens/updates the sync PR through a
+  # token that suppresses pull_request events, then dispatches CI explicitly
+  # on the repaired sync branch head.
   workflow_dispatch:
     inputs:
       ref:
diff --git a/.github/workflows/sync-upstream.yml b/.github/workflows/sync-upstream.yml
deleted file mode 100644
index b31b66ed3..000000000
--- a/.github/workflows/sync-upstream.yml
+++ /dev/null
@@ -1,122 +0,0 @@
-name: sync upstream
-
-# Keep the Darkmatter product fork close to paradigmxyz/centaur without
-# rewriting main. The workflow opens/updates a PR from `sync/upstream-main`
-# whenever upstream/main advances. Conflicts fail the run so a human can resolve
-# them explicitly in the PR branch instead of silently dropping fork changes.
-#
-# Auto-merge, CI watching, GitOps pin bumps, and Slack live in the overlay
-# workflow `upstream_sync` — this Action is the mechanical merge primitive only.
-on:
-  schedule:
-    - cron: "17 10 * * 1-5"
-  workflow_dispatch: {}
-
-permissions:
-  contents: write
-  pull-requests: write
-  actions: write
-
-concurrency:
-  group: sync-upstream-main
-  cancel-in-progress: true
-
-jobs:
-  sync:
-    if: github.repository == 'darkmatter/centaur'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Merge upstream/main into sync branch
-        id: merge
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git remote add upstream https://github.com/paradigmxyz/centaur.git
-          git fetch upstream main
-          git fetch origin main
-
-          if git merge-base --is-ancestor upstream/main origin/main; then
-            echo "changed=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          UPSTREAM_SHA=$(git rev-parse upstream/main)
-          BASE_SHA=$(git rev-parse origin/main)
-          SHORT_LOG=$(git log --oneline --no-merges "${BASE_SHA}..upstream/main" | head -40 || true)
-          COMMIT_COUNT=$(git rev-list --count "${BASE_SHA}..upstream/main")
-
-          git switch -C sync/upstream-main origin/main
-          git merge --no-edit upstream/main
-          HEAD_SHA=$(git rev-parse HEAD)
-          git push --force-with-lease origin sync/upstream-main
-          echo "changed=true" >> "$GITHUB_OUTPUT"
-          echo "head_sha=${HEAD_SHA}" >> "$GITHUB_OUTPUT"
-          echo "upstream_sha=${UPSTREAM_SHA}" >> "$GITHUB_OUTPUT"
-          echo "base_sha=${BASE_SHA}" >> "$GITHUB_OUTPUT"
-
-          BODY=$(cat <<EOF
-          <!-- centaur:upstream-sync -->
-          Merge latest \`paradigmxyz/centaur\` main into the Darkmatter product fork.
-
-          | | |
-          |---|---|
-          | upstream tip | \`${UPSTREAM_SHA}\` |
-          | previous main | \`${BASE_SHA}\` |
-          | sync head | \`${HEAD_SHA}\` |
-          | commits | ${COMMIT_COUNT} |
-
-          ### Upstream commits (first 40)
-          \`\`\`
-          ${SHORT_LOG}
-          \`\`\`
-
-          **Do not squash-merge this PR.** Use a merge commit so upstream ancestry stays intact for the next \`merge-base --is-ancestor\` check.
-
-          Conflicts fail this Action so a human resolves them on \`sync/upstream-main\`. The overlay \`upstream_sync\` workflow watches CI and auto-merges only when clean (\`gh pr merge --merge --match-head-commit\`).
-          EOF
-          )
-
-          # The overlay workflow finds merged sync PRs by --head
-          # sync/upstream-main (always works) — no label needed. The PR body
-          # carries a <!-- centaur:upstream-sync --> marker as a secondary
-          # signal. Label creation requires issues:write which the token lacks;
-          # dropping it avoids the dependency.
-          if gh pr view sync/upstream-main --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
-            gh pr edit sync/upstream-main --repo "$GITHUB_REPOSITORY" \
-              --title "sync: merge upstream main" \
-              --body "$BODY"
-          else
-            gh pr create --repo "$GITHUB_REPOSITORY" \
-              --base main \
-              --head sync/upstream-main \
-              --title "sync: merge upstream main" \
-              --body "$BODY"
-          fi
-
-      - name: Dispatch CI on sync branch head
-        # GITHUB_TOKEN-opened PRs don't trigger pull_request workflows, so
-        # required checks never appear on the sync PR head. workflow_dispatch
-        # is the one event GITHUB_TOKEN CAN trigger — dispatch CI explicitly
-        # on the sync branch so checks appear for watch_product_ci.
-        if: steps.merge.outputs.changed == 'true'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          gh workflow run ci.yml --repo "$GITHUB_REPOSITORY" --ref sync/upstream-main
-
-      - name: Summary
-        run: |
-          if [ "${{ steps.merge.outputs.changed }}" = "true" ]; then
-            echo "Opened or updated sync/upstream-main PR @ ${{ steps.merge.outputs.head_sha }}."
-            echo "Dispatched CI on sync/upstream-main."
-          else
-            echo "Already contains upstream/main."
-          fi