diff --git a/plugins/major-build/skills/app-builder/SKILL.md b/plugins/major-build/skills/app-builder/SKILL.md
index 96ccf51..7df5cc4 100644
--- a/plugins/major-build/skills/app-builder/SKILL.md
+++ b/plugins/major-build/skills/app-builder/SKILL.md
@@ -73,17 +73,11 @@ Two playbooks — use the relevant one before you start:
 
 ## Recurring work
 
-Apps no longer carry their own crons. `cron.json` is not read. For recurring work against an app's API, load the `workflow-builder` skill and build a workflow with a cron trigger and an `app_call` node.
+For recurring work, load the `workflow-builder` skill and build a workflow with a cron trigger and an `app_call` node.
 
-## Calling go-api from app code
+## Using connectors
 
-Do not construct `PostgresResourceClient`, `SlackResourceClient`, `createProxyFetch`, or any other resource client by hand. Import the generated client in `clients/`. It already copies the incoming `x-major-user-jwt`.
-
-A resource call to go-api without `x-major-user-jwt` will be rejected. A hand-rolled client that only sets `MAJOR_JWT_TOKEN` fails, including from a webhook or a workflow `app_call`.
-
-A webhook route and a workflow `app_call` are real requests. Ingress has already set `x-major-user-jwt`. `headers()` works there. Do not drop `getHeaders` so those routes can run.
-
-`MAJOR_JWT_TOKEN` alone is only for the runner and for code that is not inside a request. `current-build` and the error reporter keep using it.
+When calling connectors from an app, you must forward the `x-major-user-jwt` headers. Generated clients already pull it from header context. Without the `x-major-user-jwt` header, connector client calls will fail with insufficient permissions. When developing locally or in sandbox, we use the local `MAJOR_JWT_TOKEN` instead. This is sufficient only during development and will fail in production without `x-major-user-jwt`.
 
 ## LLM calls from app code
 
diff --git a/plugins/major-build/skills/using-connectors/SKILL.md b/plugins/major-build/skills/using-connectors/SKILL.md
index 921f726..f1fb9ab 100644
--- a/plugins/major-build/skills/using-connectors/SKILL.md
+++ b/plugins/major-build/skills/using-connectors/SKILL.md
@@ -7,7 +7,7 @@ description: Use for ANY operation against a connected resource or connector —
 
 The organization's connectors are _resources_ — external services (databases, APIs, storage, etc.) the agent and its apps reach through Major's secure clients and MCP tools. Every connector is used the same way: find the resource, read its context docs, then follow that connector's reference in this skill.
 
-App code imports the generated client in `clients/`. Do not construct a client with only `majorJwtToken`. A resource call to go-api without `x-major-user-jwt` will be rejected. A webhook route and a workflow `app_call` already have that header.
+When calling connectors from an app, you must forward the `x-major-user-jwt` headers. Generated clients already pull it from header context. Without the `x-major-user-jwt` header, connector client calls will fail with insufficient permissions. When developing locally or in sandbox, we use the local `MAJOR_JWT_TOKEN` instead. This is sufficient only during development and will fail in production without `x-major-user-jwt`.
 
 ## Step 1: List available resources