diff --git a/scripts/lib/kyasi-library.mjs b/scripts/lib/kyasi-library.mjs
index 94e04ae..adf64dc 100644
--- a/scripts/lib/kyasi-library.mjs
+++ b/scripts/lib/kyasi-library.mjs
@@ -1,6 +1,6 @@
 /**
  * Client for the federated product library at kyasi.us
- * Reads are public. Writes need KYASI_LIBRARY_TOKEN (ADMIN_API_TOKEN).
+ * Reads and writes require KYASI_LIBRARY_TOKEN (ADMIN_API_TOKEN on kyasi-net).
  */
 const DEFAULT_BASE =
   process.env.KYASI_LIBRARY_URL || "https://kyasi.us";
@@ -27,10 +27,11 @@ async function req(path, opts = {}) {
     headers["Content-Type"] = "application/json";
   }
   const token = libraryToken();
-  if (opts.auth) {
+  // All library APIs are auth-gated (session or Bearer). Machine clients use Bearer.
+  if (opts.auth !== false) {
     if (!token) {
       throw new Error(
-        "KYASI_LIBRARY_TOKEN (or ADMIN_API_TOKEN) required for library writes",
+        "KYASI_LIBRARY_TOKEN (or ADMIN_API_TOKEN) required for library access",
       );
     }
     headers.Authorization = `Bearer ${token}`;
@@ -138,5 +139,5 @@ export async function linkSiteItem(input) {
 }
 
 export async function health() {
-  return req("/api/health");
+  return req("/api/health", { auth: false });
 }
diff --git a/worker/admin.ts b/worker/admin.ts
index 88c7c0c..5a85c6b 100644
--- a/worker/admin.ts
+++ b/worker/admin.ts
@@ -995,9 +995,14 @@ export async function handleAdmin(
     // Always this site: admin panel is site-local (ibamboo), not a network hub.
     const siteId = 'ibamboo'
     try {
-      // Site-filtered list only — never call network-wide /api/stats here.
+      // Site-filtered list only. kyasi.us reads require Bearer or operator session.
+      const headers: Record<string, string> = { Accept: 'application/json' }
+      if (env.LIBRARY_TOKEN) {
+        headers.Authorization = `Bearer ${env.LIBRARY_TOKEN}`
+      }
       const itemsRes = await fetch(
         `${base}/api/library/items?site=${encodeURIComponent(siteId)}&limit=100`,
+        { headers },
       )
       const itemsPayload = (await itemsRes.json()) as {
         items?: unknown[]