diff --git a/.github/workflows/canary.yml b/.github/workflows/canary.yml
index f302dd9..a13a92f 100644
--- a/.github/workflows/canary.yml
+++ b/.github/workflows/canary.yml
@@ -42,6 +42,10 @@ on:
     # Once a day, off the hour, so it is not competing with everyone else's
     # on-the-hour cron jobs for runner availability.
     - cron: "37 7 * * *"
+    # Mondays: the same jobs, WITH the paid secrets (proxy, Scraping Browser,
+    # captcha key). On the daily run above those secrets read as empty, so
+    # it takes the free no-secret route and bills nothing.
+    - cron: "37 7 * * 1"
   workflow_dispatch:
 
 jobs:
@@ -51,8 +55,8 @@ jobs:
       # `secrets` is not available in a job-level `if`, so presence is tested
       # here, once, and read from each step's `if` and shell below. These are
       # the strings "true"/"false", never the secret itself.
-      HAVE_CDP: ${{ secrets.TRANSFERMARKT_CDP_ENDPOINT != '' }}
-      HAVE_PROXY: ${{ secrets.TRANSFERMARKT_PROXY != '' }}
+      HAVE_CDP: ${{ (github.event_name != 'schedule' || github.event.schedule == '37 7 * * 1') && secrets.TRANSFERMARKT_CDP_ENDPOINT != '' }}
+      HAVE_PROXY: ${{ (github.event_name != 'schedule' || github.event.schedule == '37 7 * * 1') && secrets.TRANSFERMARKT_PROXY != '' }}
     steps:
       - uses: actions/checkout@v4
 
@@ -93,8 +97,8 @@ jobs:
           # Through the environment, never argv (see the header). Unset
           # secrets arrive as "" and env_config.py treats that as unset, so
           # these lines are correct in both configurations.
-          TRANSFERMARKT_CDP_ENDPOINT: ${{ secrets.TRANSFERMARKT_CDP_ENDPOINT }}
-          TRANSFERMARKT_PROXY: ${{ secrets.TRANSFERMARKT_PROXY }}
+          TRANSFERMARKT_CDP_ENDPOINT: ${{ (github.event_name != 'schedule' || github.event.schedule == '37 7 * * 1') && secrets.TRANSFERMARKT_CDP_ENDPOINT || '' }}
+          TRANSFERMARKT_PROXY: ${{ (github.event_name != 'schedule' || github.event.schedule == '37 7 * * 1') && secrets.TRANSFERMARKT_PROXY || '' }}
         run: |
           set +e
           python3 playwright_scraper.py \
@@ -112,8 +116,8 @@ jobs:
         # 4 pages (77 transfers) the same day.
         continue-on-error: true
         env:
-          TRANSFERMARKT_CDP_ENDPOINT: ${{ secrets.TRANSFERMARKT_CDP_ENDPOINT }}
-          TRANSFERMARKT_PROXY: ${{ secrets.TRANSFERMARKT_PROXY }}
+          TRANSFERMARKT_CDP_ENDPOINT: ${{ (github.event_name != 'schedule' || github.event.schedule == '37 7 * * 1') && secrets.TRANSFERMARKT_CDP_ENDPOINT || '' }}
+          TRANSFERMARKT_PROXY: ${{ (github.event_name != 'schedule' || github.event.schedule == '37 7 * * 1') && secrets.TRANSFERMARKT_PROXY || '' }}
         run: |
           set +e
           python3 playwright_scraper.py \
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 123d567..af34743 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,12 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+### Changed
+
+- CI only: the canary's optional paid secrets `TRANSFERMARKT_CDP_ENDPOINT`, `TRANSFERMARKT_PROXY` now reach it only on a new weekly
+  run (Mondays 07:37 UTC) and on a manual dispatch. The daily run keeps its
+  schedule and takes the free route without them, so it bills nothing.
+
 ## [1.2.0] — 2026-10-16
 
 > **Behaviour change:** `--retries 0` is now a usage error (exit 2). It used