diff --git a/home-configs/GLOBAL_RULES.md b/home-configs/GLOBAL_RULES.md
index cdedfb6..db6df97 100644
--- a/home-configs/GLOBAL_RULES.md
+++ b/home-configs/GLOBAL_RULES.md
@@ -70,3 +70,22 @@ Use these defaults across projects, then apply any more specific repository inst
   ```
 - Read `issue.description`, `issue.status.name`, and recent non-empty `issue.journals[].notes`. If the key is missing or the request fails, report that instead of guessing the task requirements.
 - Never print, log, or write the API key into repository files.
+
+## 10. GitLab (gitlab.eltex.loc)
+
+- GitLab access uses **per-project** tokens stored in `~/.config/ai-setup/` (mode 600). Each one is a project access token and works only for its own project:
+
+  | File | Project | id |
+  | :--- | :--- | :--- |
+  | `gitlab_token_superapp` | `voip/vp-apps/superapp-launcher` | 4928 |
+  | `gitlab_token_common_library` | `voip/vp-apps/common-library` | 4825 |
+  | `gitlab_token_smart_home` | `android_apps/smart_home` | 1409 |
+
+- Pick the file matching the project you are working with. A token from another project returns HTTP 404, not 403, so a wrong token looks exactly like a missing project — check the token before concluding the resource does not exist.
+  ```bash
+  curl -fsS -H "PRIVATE-TOKEN: $(cat ~/.config/ai-setup/gitlab_token_superapp)" \
+    "https://gitlab.eltex.loc/api/v4/projects/4928/merge_requests/241"
+  ```
+- There is no generic `gitlab_token` fallback any more. Tools that accept an explicit token path (for example the `eltex-review` helper) must be given `--token-file <path>`.
+- `local.properties` in superapp-launcher also holds `gitlab.token` and `redmine.apiKey`; it is gitignored and must stay that way.
+- Never print, log, or write these tokens into repository files.