diff --git a/.github/workflows/advisories.yml b/.github/workflows/advisories.yml
deleted file mode 100644
index ae6b4f3..0000000
--- a/.github/workflows/advisories.yml
+++ /dev/null
@@ -1,57 +0,0 @@
-name: Refresh security advisories
-
-# Weekly refresh of static/data/openclaw-advisories.json, the data behind the
-# chart and table on /security/known-vulnerabilities. Fetches OpenClaw's
-# published GitHub security advisories (public data) with GITHUB_TOKEN and,
-# if the file changed, opens or updates a pull request. See scripts/README.md.
-
-on:
-  schedule:
-    - cron: '23 5 * * 1'
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  pull-requests: write
-
-concurrency:
-  group: advisories
-  cancel-in-progress: false
-
-jobs:
-  refresh:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 24
-      - name: Fetch advisories
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          node scripts/advisories.mjs --json static/data/openclaw-advisories.json > advisories-summary.md
-          cat advisories-summary.md >> "$GITHUB_STEP_SUMMARY"
-          rm advisories-summary.md
-      - name: Ignore a timestamp-only change
-        # generatedAt changes on every run; only open a PR when an advisory
-        # was added, removed or edited.
-        run: |
-          if git diff --quiet -I '"generatedAt"' -- static/data/openclaw-advisories.json; then
-            git checkout -- static/data/openclaw-advisories.json
-            echo "No advisory changes."
-          fi
-      - uses: peter-evans/create-pull-request@v8
-        with:
-          branch: bot/advisories-refresh
-          delete-branch: true
-          add-paths: static/data/openclaw-advisories.json
-          commit-message: Refresh OpenClaw security advisory data
-          title: Refresh OpenClaw security advisory data
-          body: |
-            Weekly refresh of `static/data/openclaw-advisories.json` from the
-            GitHub security advisories API (`scripts/advisories.mjs --json`).
-            Check the new advisories, and update the prose on
-            `docs/security/known-vulnerabilities.md` (batches, latest release
-            passed to `<MinimumSafeVersion>`) if they need it.
diff --git a/docs/security/known-vulnerabilities.md b/docs/security/known-vulnerabilities.md
index c5c1d7e..672d69a 100644
--- a/docs/security/known-vulnerabilities.md
+++ b/docs/security/known-vulnerabilities.md
@@ -11,7 +11,7 @@ import {AdvisoryGenerated, AdvisoryChart, AdvisoryTable, MinimumSafeVersion} fro
 
 # Known Vulnerabilities
 
-A readable record of OpenClaw's published security advisories and the major incidents around it. The advisory chart and table are generated from GitHub's [security advisories API](https://github.com/openclaw/openclaw/security/advisories) by `node scripts/advisories.mjs --json static/data/openclaw-advisories.json` in this site's repository, and a weekly workflow opens a pull request when the data changes. The prose sections below were last checked on 2026-10-18.
+A readable record of OpenClaw's published security advisories and the major incidents around it. The advisory chart and table are generated from GitHub's [security advisories API](https://github.com/openclaw/openclaw/security/advisories) by `node scripts/advisories.mjs --json static/data/openclaw-advisories.json` in this site's repository; the data is refreshed by hand (last on 2026-10-18). The prose sections below were last checked on 2026-10-18.
 
 :::danger[Minimum safe version: the latest stable release]
 As of 2026-10-18 the latest stable release is **v2026.10.4** (published 2026-10-16). Always run the latest stable release, and update plugins with it:
diff --git a/scripts/README.md b/scripts/README.md
index 400f0bb..33fe9bd 100644
--- a/scripts/README.md
+++ b/scripts/README.md
@@ -100,14 +100,12 @@ node scripts/advisories.mjs --json static/data/openclaw-advisories.json
 node scripts/advisories.mjs --file adv.jsonl --json static/data/openclaw-advisories.json
 ```
 
-`.github/workflows/advisories.yml` runs this every Monday (and on manual
-dispatch) with the workflow's `GITHUB_TOKEN`. If any advisory changed (a
-`generatedAt`-only change is ignored), it opens or updates a PR from
-`bot/advisories-refresh` via `peter-evans/create-pull-request`. When merging,
-check whether the page's prose (batch sections, the latest release passed to
-`<MinimumSafeVersion latest="...">`) needs updating too. PRs opened with
-`GITHUB_TOKEN` don't trigger other workflows; re-run the snippet check by hand
-or push a commit to the branch if needed.
+Refreshing is manual for now: run the command above, and if the JSON changed
+(not just `generatedAt`), open a PR with it. When merging, check whether the
+page's prose (batch sections, the latest release passed to
+`<MinimumSafeVersion latest="...">`) needs updating too. A scheduled workflow
+that opens the PR automatically was removed until the repo allows GitHub
+Actions to create pull requests.
 
 ## Tutorial tests (`tutorial-tests/`)
 
diff --git a/src/components/AdvisoryTimeline.tsx b/src/components/AdvisoryTimeline.tsx
index 7786e04..9b0a218 100644
--- a/src/components/AdvisoryTimeline.tsx
+++ b/src/components/AdvisoryTimeline.tsx
@@ -2,7 +2,7 @@
 //
 // Data: static/data/openclaw-advisories.json, written by
 // `node scripts/advisories.mjs --json static/data/openclaw-advisories.json`
-// and refreshed weekly by .github/workflows/advisories.yml. The JSON is
+// and refreshed by hand (see scripts/README.md). The JSON is
 // imported (not fetched) so the chart and table are in the static HTML.
 // No window access at module scope; everything renders in SSR.