diff --git a/.forgejo/workflows/build.yaml b/.forgejo/workflows/build.yaml
index 29ad744..2487880 100644
--- a/.forgejo/workflows/build.yaml
+++ b/.forgejo/workflows/build.yaml
@@ -98,22 +98,24 @@ jobs:
 
       - name: Update GitOps release
         env:
-          GITEOPS_REPO: ${{ secrets.GITEOPS_REPO }}
-          GITEOPS_SSH_KEY: ${{ secrets.GITEOPS_SSH_KEY }}
+          GITOPS_SERVER: ${{ secrets.GITOPS_SERVER || 'ci.nxtgauge.com' }}
+          GITOPS_OWNER: ${{ secrets.GITOPS_OWNER || 'ashwin' }}
+          GITOPS_REPO: ${{ secrets.GITOPS_REPO || 'nxtgauge-gitops' }}
+          GITOPS_BRANCH: ${{ secrets.GITOPS_BRANCH || 'main' }}
+          # The gitops repo lives on Forgejo (ci.nxtgauge.com), not GitHub -
+          # GITEOPS_REPO/GITEOPS_SSH_KEY were never actually configured as
+          # repo secrets (only GITOPS_GITHUB_* and GITOPS_PAT exist, per
+          # nxtgauge-backend-rust's already-fixed workflow). Use GITOPS_PAT.
+          GITOPS_PAT: ${{ secrets.GITOPS_PAT }}
           SHA: ${{ github.sha }}
         run: |
           set -euo pipefail
-          test -n "$GITEOPS_REPO"
-          test -n "$GITEOPS_SSH_KEY"
+          test -n "${GITOPS_PAT:-}" || { echo "GITOPS_PAT is empty"; exit 1; }
 
-          mkdir -p ~/.ssh
-          printf '%s\n' "$GITEOPS_SSH_KEY" > ~/.ssh/id_ed25519
-          chmod 600 ~/.ssh/id_ed25519
-          for host in github.com ci.nxtgauge.com; do ssh-keyscan -H "$host" >> ~/.ssh/known_hosts 2>/dev/null || true; done
-
-          GITEOPS_DIR=$(mktemp -d)
-          git clone "$GITEOPS_REPO" "$GITEOPS_DIR"
-          cd "$GITEOPS_DIR"
+          GITOPS_DIR=$(mktemp -d)
+          git clone "https://forgejo-actions:${GITOPS_PAT}@${GITOPS_SERVER}/${GITOPS_OWNER}/${GITOPS_REPO}.git" "$GITOPS_DIR"
+          cd "$GITOPS_DIR"
+          git checkout "$GITOPS_BRANCH"
 
           image_ref="$(cat /tmp/admin-solid-image-ref.txt)"
           ./scripts/set-app-release.sh admin-solid "$image_ref"
@@ -127,4 +129,4 @@ jobs:
           git config user.email "forgejo-actions@ci.nxtgauge.com"
           git add apps scripts/set-app-release.sh
           git commit -m "chore(gitops): deploy admin-solid@${SHA}"
-          git push
+          git push origin "HEAD:${GITOPS_BRANCH}"