diff --git a/.github/workflows/canary.yml b/.github/workflows/canary.yml
index ee73869..2f1776a 100644
--- a/.github/workflows/canary.yml
+++ b/.github/workflows/canary.yml
@@ -37,6 +37,10 @@ on:
     # Once a day, off the hour, so it is not competing with everyone else's
     # on-the-hour cron jobs for runner availability.
     - cron: "23 6 * * *"
+    # Mondays: the same jobs, WITH the paid secrets (proxy, Scraping Browser,
+    # captcha key). On the daily run above those secrets read as empty, so
+    # it takes the free no-secret route and bills nothing.
+    - cron: "23 6 * * 1"
   workflow_dispatch:
 
 jobs:
@@ -84,7 +88,7 @@ jobs:
           # Empty when the secret is not set, which env_config.py treats as
           # unset — so this line is correct in both cases and needs no edit
           # when the secret arrives. See the header.
-          AMAZON_PROXY: ${{ secrets.AMAZON_PROXY }}
+          AMAZON_PROXY: ${{ (github.event_name != 'schedule' || github.event.schedule == '23 6 * * 1') && secrets.AMAZON_PROXY || '' }}
         run: |
           set +e
           python3 playwright_scraper.py \
@@ -267,7 +271,7 @@ jobs:
         # interpretation step.
         continue-on-error: true
         env:
-          AMAZON_PROXY: ${{ secrets.AMAZON_PROXY }}
+          AMAZON_PROXY: ${{ (github.event_name != 'schedule' || github.event.schedule == '23 6 * * 1') && secrets.AMAZON_PROXY || '' }}
         run: |
           set +e
           python3 playwright_scraper.py --mode product \
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a13bda1..6725a70 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,12 @@ one, and when it does the release notes say so first.
 
 ## [Unreleased]
 
+### Changed
+
+- CI only: the canary's optional paid secret `AMAZON_PROXY` now reaches it only on a new weekly
+  run (Mondays 06:23 UTC) and on a manual dispatch. The daily run keeps its
+  schedule and takes the free route without them, so it bills nothing.
+
 ## [0.2.0] — 2026-10-15
 
 > **Behaviour changes from the 2026-10-14 audit fixes:**