diff --git a/.github/workflows/security-nightly.yml b/.github/workflows/security-nightly.yml
index da7f76d..c652b65 100644
--- a/.github/workflows/security-nightly.yml
+++ b/.github/workflows/security-nightly.yml
@@ -3,8 +3,10 @@ name: security-nightly
 
 on:
   schedule:
-    - cron: "38 13 * * 1-6"   # Mon-Sat 13:38 UTC: incremental secrets window
-    - cron: "38 13 * * 0"     # Sunday: full git history for gitleaks
+    - cron: "39 2 * * 1-6"   # Mon-Sat 2:39 AM Pacific: incremental secrets window
+      timezone: "America/Los_Angeles"
+    - cron: "39 2 * * 0"     # Sunday 2:39 AM Pacific: full git history for gitleaks
+      timezone: "America/Los_Angeles"
   workflow_dispatch:
     inputs:
       secrets-mode:
@@ -38,7 +40,7 @@ jobs:
       runs-on: '["self-hosted","macOS","ARM64"]'
       profile: nightly
       enforce-workflow-lint: true   # actionlint + zizmor (medium+) must pass; clean as of 2026-10-26
-      secrets-mode: ${{ inputs.secrets-mode || (github.event.schedule == '38 13 * * 0' && 'full' || 'incremental') }}
+      secrets-mode: ${{ inputs.secrets-mode || (github.event.schedule == '39 2 * * 0' && 'full' || 'incremental') }}
       deps: false             # secrets only: no dependency manifests to scan
       upload-sarif: false     # no GHAS code scanning
       upload-secret-report: false