diff --git a/.forgejo/workflows/build.yaml b/.forgejo/workflows/build.yaml
index 9d45ac5..6ac6ae7 100644
--- a/.forgejo/workflows/build.yaml
+++ b/.forgejo/workflows/build.yaml
@@ -156,15 +156,19 @@ jobs:
           GITOPS_OWNER: ${{ secrets.GITOPS_OWNER || 'ashwin' }}
           GITOPS_REPO: ${{ secrets.GITOPS_REPO || 'nxtgauge-gitops' }}
           GITOPS_BRANCH: ${{ secrets.GITOPS_BRANCH || 'main' }}
-          GITOPS_PUSH_USERNAME: ${{ secrets.GITOPS_PUSH_USERNAME }}
-          GITOPS_PUSH_TOKEN: ${{ secrets.GITOPS_PUSH_TOKEN }}
+          # The gitops repo now lives on Forgejo (ci.nxtgauge.com), not
+          # GitHub - GITOPS_PUSH_USERNAME/GITOPS_PUSH_TOKEN were never
+          # actually configured as repo secrets (only the leftover
+          # GITOPS_GITHUB_* pair and GITOPS_PAT exist). Use GITOPS_PAT,
+          # which matches the current Forgejo-hosted repo.
+          GITOPS_PAT: ${{ secrets.GITOPS_PAT }}
           SHA: ${{ github.sha }}
         run: |
           set -euo pipefail
-          test -n "${GITOPS_PUSH_TOKEN:-}" || { echo "GITOPS_PUSH_TOKEN is empty"; exit 1; }
+          test -n "${GITOPS_PAT:-}" || { echo "GITOPS_PAT is empty"; exit 1; }
           service="${{ matrix.service }}"
 
-          git clone "https://${GITOPS_PUSH_USERNAME}:${GITOPS_PUSH_TOKEN}@${GITOPS_SERVER}/${GITOPS_OWNER}/${GITOPS_REPO}.git" /tmp/nxtgauge-gitops
+          git clone "https://forgejo-actions:${GITOPS_PAT}@${GITOPS_SERVER}/${GITOPS_OWNER}/${GITOPS_REPO}.git" /tmp/nxtgauge-gitops
           cd /tmp/nxtgauge-gitops
 
           # Up to 3 of these jobs can be pushing to the same gitops branch at