diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2b4051a9..44341109 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -164,7 +164,7 @@ jobs:
   update-screenshots:
     runs-on: ubuntu-latest
     # Only on develop pushes; skip bot commits to avoid an infinite loop
-    if: github.event_name == 'push' && github.ref == 'refs/heads/develop' && !contains(github.event.head_commit.message, 'docs: refresh screenshots')
+    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/develop' && !contains(github.event.head_commit.message, 'docs: refresh screenshots') }}
     needs: [ backend, frontend ]
     permissions:
       contents: write
@@ -252,6 +252,7 @@ jobs:
       - name: Commit and push to sencho-docs
         working-directory: sencho-docs
         run: |
+          git config --global --add safe.directory "$GITHUB_WORKSPACE/sencho-docs"
           git config user.email "docs-bot@sencho.io"
           git config user.name "Sencho Docs Bot"
           git add -A
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 42e703fe..81f7dfca 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - feat: automated documentation pipeline with Mintlify sync
 - feat: CI job to auto-refresh doc screenshots on every develop push
 
+### Fixed
+- fix(ci): YAML syntax error in update-screenshots `if:` condition (`!` tag and `: ` in plain scalar); wrapped in `${{ }}`
+- fix(ci): `sync-docs` job failing with "fatal: not in a git directory"; added `safe.directory` config for the sencho-docs checkout path
+
 ### Fixed
 - **COOP header console warning on HTTP deployments:** Helmet sends `Cross-Origin-Opener-Policy: same-origin` by default, which browsers silently ignore over HTTP but log as a console error. Disabled via `crossOriginOpenerPolicy: false` — same rationale as the existing HSTS and COEP disables.
 - **Inline script CSP violation from Vite module-preload polyfill:** Vite's production build injects a small inline `<script>` for the module-preload polyfill that was blocked by `script-src 'self'`. Disabled via `build.modulePreload.polyfill: false` in `vite.config.ts` — all modern browsers support `<link rel="modulepreload">` natively.