diff --git a/ordinis-outbox/src/main/java/cloud/nstart/terravault/ordinis/outbox/webhook/WebhookDispatcher.java b/ordinis-outbox/src/main/java/cloud/nstart/terravault/ordinis/outbox/webhook/WebhookDispatcher.java
index fd6428b..e6bd265 100644
--- a/ordinis-outbox/src/main/java/cloud/nstart/terravault/ordinis/outbox/webhook/WebhookDispatcher.java
+++ b/ordinis-outbox/src/main/java/cloud/nstart/terravault/ordinis/outbox/webhook/WebhookDispatcher.java
@@ -226,7 +226,16 @@ public class WebhookDispatcher {
           .uri(URI.create(sub.getUrl()))
           .timeout(Duration.ofMillis(sendTimeoutMs))
           .header("Content-Type", "application/json")
-          .header("User-Agent", "Ordinis-Webhook/1.0")
+          // Webhook Bot identifies sender by User-Agent (see incoming subscription
+          // allowlist). Value 'ordinis-alerts' matches subscription name на стороне
+          // chat.nstart.cloud — пишется literally without version suffix.
+          //
+          // NB: для override этого header'а нужен JVM flag
+          // `-Djdk.httpclient.allowRestrictedHeaders=user-agent` (см. ordinis-infra
+          // values.yaml / writer.yaml args). Без flag Java HttpClient silently drops
+          // user-set User-Agent → receiver видит Java-http-client/<jvm-version>
+          // → Webhook Bot не находит subscription → 'неизвестный webhook'.
+          .header("User-Agent", "ordinis-alerts")
           .header(HmacSigner.HEADER_NAME, signature)
           .header("X-Ordinis-Event-Id", String.valueOf(event.getId()))
           .header("X-Ordinis-Event-Type", event.getEventType())