diff --git a/scripts/edoxid_calendar_gmail.py b/scripts/edoxid_calendar_gmail.py
index af5d18d..b0bc631 100644
--- a/scripts/edoxid_calendar_gmail.py
+++ b/scripts/edoxid_calendar_gmail.py
@@ -15,13 +15,18 @@ class GmailService:
     langsung (scope gmail.send, akun OAuth yang sama dengan Calendar)."""
 
     def __init__(self, config: GoogleConfig):
+        # Sengaja TIDAK set `scopes=` di sini: refresh_token sudah membawa scope
+        # gabungan (calendar + gmail.send) dari OAuth consent aslinya. Meminta
+        # scope yang lebih sempit secara eksplisit saat refresh terbukti bisa
+        # ditolak Google dengan `invalid_scope` tergantung versi google-auth
+        # yang jalan (dites 2026-07-27: lolos di lokal, gagal di container
+        # Airflow karena google-auth versi lain via apache-airflow-providers-google).
         creds = Credentials(
             token=None,
             refresh_token=config.refresh_token,
             token_uri="https://oauth2.googleapis.com/token",
             client_id=config.client_id,
             client_secret=config.client_secret,
-            scopes=["https://www.googleapis.com/auth/gmail.send"],
         )
         creds.refresh(Request())
 
diff --git a/scripts/edoxid_calendar_google.py b/scripts/edoxid_calendar_google.py
index bcf3f91..08bb891 100644
--- a/scripts/edoxid_calendar_google.py
+++ b/scripts/edoxid_calendar_google.py
@@ -127,13 +127,16 @@ class GoogleCalendarService:
     def __init__(self, config: GoogleConfig):
         self._calendar_id = config.calendar_id
 
+        # Sengaja TIDAK set `scopes=` — lihat catatan di GmailService.__init__
+        # (edoxid_calendar_gmail.py) soal `invalid_scope` yang muncul di
+        # container Airflow (google-auth versi lain) saat scope refresh
+        # diminta lebih sempit dari yang tercakup refresh_token aslinya.
         creds = Credentials(
             token=None,
             refresh_token=config.refresh_token,
             token_uri="https://oauth2.googleapis.com/token",
             client_id=config.client_id,
             client_secret=config.client_secret,
-            scopes=["https://www.googleapis.com/auth/calendar"],
         )
         creds.refresh(Request())