diff --git a/apps/django/uralkal/zitadel-action-configmap.yaml b/apps/django/uralkal/zitadel-action-configmap.yaml
index 64660dc..daadca5 100644
--- a/apps/django/uralkal/zitadel-action-configmap.yaml
+++ b/apps/django/uralkal/zitadel-action-configmap.yaml
@@ -77,20 +77,34 @@ data:
     client = httpx.Client(base_url=ZITADEL, headers=HEADERS, timeout=30)
 
 
-    def call(method, path, body=None, org_id=None):
+    def call(method, path, body=None, org_id=None, allow=()):
         headers = {"x-zitadel-orgid": org_id} if org_id else {}
         r = client.request(method, path, json=body, headers=headers)
+        if r.status_code in allow:
+            return None
         if r.status_code >= 300:
             print(f"{method} {path} -> {r.status_code}: {r.text}")
             sys.exit(1)
         return r.json() if r.content else {}
 
 
-    orgs = call("POST", "/admin/v1/orgs/_search", {"queries": []}).get("result", [])
-    org = next((o for o in orgs if o.get("name", "").lower() == ORG_NAME.lower()), None)
-    if org is None:
-        print(f"org '{ORG_NAME}' not found, available: {[o.get('name') for o in orgs]}")
-        sys.exit(1)
+    me = call("GET", "/auth/v1/users/me")["user"]
+    print(f"token user {me.get('userName')} id={me.get('id')}")
+
+    org = None
+    found_orgs = call("POST", "/admin/v1/orgs/_search", {"queries": []}, allow=(403,))
+    if found_orgs is not None:
+        orgs = found_orgs.get("result", [])
+        org = next((o for o in orgs if o.get("name", "").lower() == ORG_NAME.lower()), None)
+        if org is None:
+            print(f"org '{ORG_NAME}' not found, available: {[o.get('name') for o in orgs]}")
+            sys.exit(1)
+    else:
+        org = call("GET", "/management/v1/orgs/me")["org"]
+        print(f"no instance permissions, using token org '{org.get('name')}'")
+        if org.get("name", "").lower() != ORG_NAME.lower():
+            print(f"token org is '{org.get('name')}', not '{ORG_NAME}'")
+            sys.exit(1)
     org_id = org["id"]
     print(f"org {org['name']} id={org_id}")