diff --git a/.forgejo/workflows/build.yaml b/.forgejo/workflows/build.yaml
index 77918fc..33b00a1 100644
--- a/.forgejo/workflows/build.yaml
+++ b/.forgejo/workflows/build.yaml
@@ -82,33 +82,47 @@ jobs:
 
       - name: Update GitOps release
         env:
-          GITEOPS_REPO: ${{ secrets.GITEOPS_REPO }}
-          GITEOPS_SSH_KEY: ${{ secrets.GITEOPS_SSH_KEY }}
+          GITOPS_SERVER: ${{ secrets.GITOPS_SERVER || 'ci.nxtgauge.com' }}
+          GITOPS_OWNER: ${{ secrets.GITOPS_OWNER || 'ashwin' }}
+          GITOPS_REPO: ${{ secrets.GITOPS_REPO || 'nxtgauge-gitops' }}
+          GITOPS_BRANCH: ${{ secrets.GITOPS_BRANCH || 'main' }}
+          # The gitops repo lives on Forgejo (ci.nxtgauge.com), not GitHub.
+          # GITEOPS_REPO/GITEOPS_SSH_KEY were never configured as repo
+          # secrets; use GITOPS_PAT instead, matching backend-rust.
+          GITOPS_PAT: ${{ secrets.GITOPS_PAT }}
           SHA: ${{ github.sha }}
         run: |
           set -euo pipefail
-          test -n "$GITEOPS_REPO"
-          test -n "$GITEOPS_SSH_KEY"
-
-          mkdir -p ~/.ssh
-          printf '%s\n' "$GITEOPS_SSH_KEY" > ~/.ssh/id_ed25519
-          chmod 600 ~/.ssh/id_ed25519
-          ssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/null
+          test -n "${GITOPS_PAT:-}" || { echo "GITOPS_PAT is empty"; exit 1; }
 
           GITEOPS_DIR=$(mktemp -d)
-          git clone "$GITEOPS_REPO" "$GITEOPS_DIR"
+          git clone "https://forgejo-actions:${GITOPS_PAT}@${GITOPS_SERVER}/${GITOPS_OWNER}/${GITOPS_REPO}.git" "$GITEOPS_DIR"
           cd "$GITEOPS_DIR"
 
           image_ref="$(cat /tmp/ai-assistant-image-ref.txt)"
-          ./scripts/set-app-release.sh ai-assistant "$image_ref"
 
-          if git diff --quiet; then
-            echo "GitOps repo already up to date."
-            exit 0
-          fi
+          for attempt in 1 2 3 4 5; do
+            git checkout "$GITOPS_BRANCH"
+            ./scripts/set-app-release.sh ai-assistant "$image_ref"
 
-          git config user.name "forgejo-actions[bot]"
-          git config user.email "forgejo-actions@ci.nxtgauge.com"
-          git add apps scripts/set-app-release.sh
-          git commit -m "chore(gitops): deploy ai-assistant@${SHA}"
-          git push
+            if git diff --quiet; then
+              echo "GitOps repo already up to date."
+              exit 0
+            fi
+
+            git config user.name "forgejo-actions[bot]"
+            git config user.email "forgejo-actions@ci.nxtgauge.com"
+            git add apps scripts/set-app-release.sh
+            git commit -m "chore(gitops): deploy ai-assistant@${SHA}"
+
+            if git push origin "HEAD:$GITOPS_BRANCH"; then
+              exit 0
+            fi
+
+            echo "Push rejected (attempt $attempt), pulling latest and retrying..."
+            git fetch origin "$GITOPS_BRANCH"
+            git reset --hard "origin/$GITOPS_BRANCH"
+          done
+
+          echo "Failed to push GitOps update after retries" >&2
+          exit 1