diff --git a/.github/workflows/canary.yml b/.github/workflows/canary.yml
index 9819857..fb015e7 100644
--- a/.github/workflows/canary.yml
+++ b/.github/workflows/canary.yml
@@ -26,6 +26,10 @@ on:
   schedule:
     # 05:40 UTC. Not on the hour: every scheduled workflow fires at :00.
     - cron: "40 5 * * *"
+    # Mondays: the same jobs, WITH the paid secrets (proxy, Scraping Browser,
+    # captcha key). On the daily run above those secrets read as empty, so
+    # it takes the free no-secret route and bills nothing.
+    - cron: "40 5 * * 1"
   workflow_dispatch:
 
 permissions:
@@ -62,7 +66,7 @@ jobs:
             args: "--asset USDT --fiat EUR --side buy"
             floor: 40
     env:
-      BINANCE_PROXY: ${{ secrets.BINANCE_PROXY }}
+      BINANCE_PROXY: ${{ (github.event_name != 'schedule' || github.event.schedule == '40 5 * * 1') && secrets.BINANCE_PROXY || '' }}
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4b31228..55851be 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,12 @@ said so at the top of its release notes.
 
 ## [Unreleased]
 
+### Changed
+
+- CI only: the canary's optional paid secret `BINANCE_PROXY` now reaches it only on a new weekly
+  run (Mondays 05:40 UTC) and on a manual dispatch. The daily run keeps its
+  schedule and takes the free route without them, so it bills nothing.
+
 ## [0.3.0] — 2026-10-15
 
 > **Behaviour change:** `--retries 0` is now a usage error (exit 2). It used
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 908a7e9..740d04d 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -91,7 +91,9 @@ Then the rest of the presentation, in the order that matters:
    the README makes. Its first dispatch (2026-09-24) was served in all
    three modes from a GitHub-hosted runner with no proxy. If a later run
    is refused for the runner's address, the canary's `BINANCE_PROXY`
-   secret (an exit elsewhere) is the fix, with no workflow edit.
+   secret (an exit elsewhere) is used on the weekly (Monday) run and on a
+   manual dispatch, with no workflow edit; the daily run stays on the
+   runner's own address and bills nothing.
 2. The repo description, homepage and topics set: the engines, the
    2Captcha Scraping Browser API by that name, and what the site publishes.
 3. Only then the row in the org profile README — and check it with an