diff --git a/.github/workflows/scripts/pve-run-script.sh b/.github/workflows/scripts/pve-run-script.sh
index 1a6d495d8..cd47e7150 100644
--- a/.github/workflows/scripts/pve-run-script.sh
+++ b/.github/workflows/scripts/pve-run-script.sh
@@ -739,12 +739,19 @@ run_update() {
   : >"$raw"
   token=$(head -c 16 /dev/urandom | od -An -tx1 | tr -d ' \n')
   echo "──────── $2 (live) ────────"
+  # Diagnosis (temporary): a curl wrapper in the guest notes every
+  # api.github.com call and whether it carried a token (never the token).
   if [[ "$PLATFORM" == "incus" ]]; then guest_cmd_probe=(incus exec "$ctid" --); else guest_cmd_probe=(pct exec "$ctid" --); fi
-  # Diagnosis: does the token reach a GitHub call inside the guest?
-  [[ -n "${GH_API_TOKEN:-}" ]] && echo "Token inside the guest: $("${guest_cmd_probe[@]}" env GITHUB_TOKEN="$GH_API_TOKEN" sh -c \
-    'printf "%s chars, " "${#GITHUB_TOKEN}"; curl -s --max-time 10 -o /dev/null -w "%{http_code}" -H "Authorization: Bearer $GITHUB_TOKEN" https://api.github.com/repos/cli/cli/releases/latest' 2>&1)"
-  [[ -n "${GH_API_TOKEN:-}" ]] && echo "Token after the guest's profile: $("${guest_cmd_probe[@]}" env GITHUB_TOKEN="$GH_API_TOKEN" bash -c \
-    'for f in /etc/profile.d/*.sh; do . "$f" >/dev/null 2>&1; done; . /root/.profile >/dev/null 2>&1; printf "%s chars; " "${#GITHUB_TOKEN}"; grep -rlsE "GITHUB_TOKEN|var_github_token" /etc/profile.d /root/.profile /root/.bashrc /etc/environment /etc/bash.bashrc | tr "\n" " "' 2>&1)"
+  "${guest_cmd_probe[@]}" sh -c 'cat >/usr/local/sbin/curl <<"W"
+#!/bin/sh
+case "$*" in *api.github.com*)
+  a=no; case "$*" in *"Authorization: Bearer "?*) a=yes ;; esac
+  u=$(printf "%s\n" "$@" | grep -m1 api.github.com)
+  echo "auth=$a env=${#GITHUB_TOKEN} $u" >>/tmp/ci-gh-calls.log ;;
+esac
+exec /usr/bin/curl "$@"
+W
+chmod 755 /usr/local/sbin/curl; : >/tmp/ci-gh-calls.log' 2>/dev/null || true
   echo "::stop-commands::${token}"
   # timeout runs a program, not a shell function, so spell out the exec here.
   if [[ "$PLATFORM" == "incus" ]]; then guest_cmd=(incus exec "$ctid" --); else guest_cmd=(pct exec "$ctid" --); fi
@@ -757,6 +764,8 @@ run_update() {
   update_pid=""
   sleep 1
   echo "::${token}::"
+  echo "GitHub API calls in the guest during $2:"
+  "${guest_cmd_probe[@]}" sh -c 'cat /tmp/ci-gh-calls.log; rm -f /usr/local/sbin/curl /tmp/ci-gh-calls.log' 2>/dev/null | sed 's/^/  /' || true
 }
 run_update "$UPDATE_RAW" "update test"