diff --git a/velero/restore-drill/10-drill-script-configmap.yaml b/velero/restore-drill/10-drill-script-configmap.yaml
index 6998cb7..03d7362 100644
--- a/velero/restore-drill/10-drill-script-configmap.yaml
+++ b/velero/restore-drill/10-drill-script-configmap.yaml
@@ -58,9 +58,16 @@ data:
       printf '{"source":"velero-restore-drill","status":"%s","timestamp":"%s","backup":"%s","restore":"%s","restore_phase":"%s","restore_duration_s":"%s","target_namespace":"%s","source_namespace":"%s","diff_summary":"%s"}\n' \
         "${status}" "${TS}" "${backup}" "${restore}" "${restore_phase}" \
         "${restore_duration_s}" "${target_ns}" "${source_ns}" "${diff_summary}" > "${body_file}"
+      # DEV-590: trigger is in github_hmac signingMode. Compute HMAC-SHA256 over
+      # the raw body and send X-Hub-Signature-256; sending Authorization: Bearer
+      # here is a trap because the home Paperclip's global actor middleware
+      # rejects any Bearer header that is not a board API key or agent JWT
+      # before the per-trigger handler runs.
+      local sig
+      sig=$(openssl dgst -sha256 -hmac "${PAPERCLIP_WEBHOOK_SECRET}" -r "${body_file}" | awk '{print $1}')
       local hc
       hc=$(curl -sS -o /tmp/webhook.out -w '%{http_code}' -m 30 \
-             -X POST -H "Authorization: Bearer ${PAPERCLIP_WEBHOOK_SECRET}" \
+             -X POST -H "X-Hub-Signature-256: sha256=${sig}" \
              -H "Content-Type: application/json" \
              --data-binary "@${body_file}" \
              "${PAPERCLIP_WEBHOOK_URL}" 2>&1) || hc="000"
diff --git a/velero/restore-drill/README.md b/velero/restore-drill/README.md
index b2a7cc2..024dec7 100644
--- a/velero/restore-drill/README.md
+++ b/velero/restore-drill/README.md
@@ -27,6 +27,14 @@ Velero cluster-reconstruction backup layer.
    the `velero-restore-drill-webhook` Secret is present. The CronJob uses a
    `hostAliases` entry to route `paperclip.home.imicros.de` at the home
    public IP so the webhook reaches the routine from Hetzner (DEV-579).
+   Authentication is `github_hmac` — the script computes an HMAC-SHA256
+   of the raw body with the webhook secret as key and sends it as
+   `X-Hub-Signature-256: sha256=<hex>`. The matching trigger `signingMode`
+   is `github_hmac` on routine `c9d941fa-fb97-4e6a-a305-8e46f296e0cd`.
+   Previously it was `bearer`, but the home Paperclip's global actor
+   middleware rejects any `Authorization: Bearer …` whose value is not a
+   board API key or an agent JWT before the per-trigger handler runs,
+   making the bearer path unreachable (DEV-590).
 
 ## Failure signalling