diff --git a/README.md b/README.md
index c6f2ebbf9d6..e2d5ae54e7d 100644
--- a/README.md
+++ b/README.md
@@ -1,10 +1,10 @@
 # GitHub CLI
 
+GitHub CLI, or the gh CLI, is GitHub on the command line. It brings pull requests, issues, and other GitHub concepts to the terminal next to where you are already working with `git` and your code.
+
 > [!IMPORTANT]
 > GitHub CLI's PGP signing key rotation for Linux package repositories is effective September 5, 2026; users experiencing package installation or update problems can find solutions in the [public announcement](https://github.com/cli/cli/issues/13118).
 
-`gh` is GitHub on the command line. It brings pull requests, issues, and other GitHub concepts to the terminal next to where you are already working with `git` and your code.
-
 ![screenshot of gh pr status](https://user-images.githubusercontent.com/98482/84171218-327e7a80-aa40-11ea-8cd1-5177fc2d0e72.png)
 
 GitHub CLI is supported for users on GitHub.com, GitHub Enterprise Cloud, and [supported GitHub Enterprise Server versions](https://docs.github.com/en/enterprise-server/admin/all-releases), with support for macOS, Windows, and Linux.
diff --git a/internal/attachments/client.go b/internal/attachments/client.go
index cc860cbc18a..1d42f4abb3a 100644
--- a/internal/attachments/client.go
+++ b/internal/attachments/client.go
@@ -68,11 +68,13 @@ func checkHost(host string) error {
 	return nil
 }
 
-// uploadTokenTypes lists the credentials that can attach a file.
+// uploadTokenTypes lists the credentials that can attach a file. Some GitHub
+// App user-to-server tokens are supported, so the endpoint decides which.
 var uploadTokenTypes = []gh.TokenType{
 	gh.TokenTypeOAuth,
 	gh.TokenTypePersonalAccess,
 	gh.TokenTypeFineGrainedPAT,
+	gh.TokenTypeUserToServer,
 }
 
 // checkUploadTokenType rejects a credential that cannot upload. It is an
diff --git a/internal/attachments/client_test.go b/internal/attachments/client_test.go
index 8801f770603..1874bbd053b 100644
--- a/internal/attachments/client_test.go
+++ b/internal/attachments/client_test.go
@@ -409,6 +409,13 @@ func TestNewUploader(t *testing.T) {
 			targetRepository: 42,
 			viewerPermission: "WRITE",
 		},
+		{
+			name:             "App user-to-server token",
+			tokenType:        gh.TokenTypeUserToServer,
+			host:             "github.com",
+			targetRepository: 42,
+			viewerPermission: "WRITE",
+		},
 		{
 			name:             "rejects an enterprise server host",
 			tokenType:        gh.TokenTypeOAuth,
@@ -428,14 +435,6 @@ func TestNewUploader(t *testing.T) {
 			viewerPermission: "WRITE",
 			wantErr:          "attaching files is not supported on GitHub Enterprise Server",
 		},
-		{
-			name:             "rejects an App user-to-server token",
-			tokenType:        gh.TokenTypeUserToServer,
-			host:             "github.com",
-			targetRepository: 42,
-			viewerPermission: "WRITE",
-			wantErr:          badTokenErr,
-		},
 		{
 			name:             "rejects an App server-to-server token",
 			tokenType:        gh.TokenTypeServerToServer,
diff --git a/skills/gh/SKILL.md b/skills/gh/SKILL.md
index e1f974aca72..a4c127eb9c7 100644
--- a/skills/gh/SKILL.md
+++ b/skills/gh/SKILL.md
@@ -126,7 +126,8 @@ blocked-by/blocking relationships.
   of `--body`, `--body-file`, or `--editor`.
 - Uploads require GitHub.com or a GHE.com tenant, an OAuth token, classic PAT,
   or fine-grained PAT, and `WRITE`, `MAINTAIN`, or `ADMIN` repository
-  permission. GitHub Enterprise Server and GitHub App tokens are unsupported.
+  permission. GitHub Enterprise Server and most GitHub App tokens are
+  unsupported.
 - Uploads stop at the first failure. If earlier files uploaded, `gh` still
   writes those attachments and exits non-zero. Create and edit commands also
   print the issue or pull request URL.