diff --git a/.forgejo/workflows/build.yaml b/.forgejo/workflows/build.yaml
index 0363ea9..b64f290 100644
--- a/.forgejo/workflows/build.yaml
+++ b/.forgejo/workflows/build.yaml
@@ -98,22 +98,22 @@ jobs:
 
       - name: Update GitOps release
         env:
-          GITOPS_SERVER: ${{ secrets.GITOPS_SERVER || 'ci.nxtgauge.com' }}
-          GITOPS_OWNER: ${{ secrets.GITOPS_OWNER || 'ashwin' }}
+          GITOPS_GITHUB_OWNER: ${{ secrets.GITOPS_GITHUB_OWNER || 'Traceworks2023' }}
           GITOPS_REPO: ${{ secrets.GITOPS_REPO || 'nxtgauge-gitops' }}
           GITOPS_BRANCH: ${{ secrets.GITOPS_BRANCH || 'main' }}
-          # The gitops repo lives on Forgejo (ci.nxtgauge.com), not GitHub -
-          # GITEOPS_REPO/GITEOPS_SSH_KEY were never actually configured as
-          # repo secrets (only GITOPS_GITHUB_* and GITOPS_PAT exist, per
-          # nxtgauge-backend-rust's already-fixed workflow). Use GITOPS_PAT.
-          GITOPS_PAT: ${{ secrets.GITOPS_PAT }}
+          # GitHub is the source of truth for nxtgauge-gitops. Push there;
+          # the repo's own sync-to-forgejo.yml GitHub Action relays the
+          # commit to Forgejo, which is what Flux (flux-system GitRepository)
+          # actually watches. Do not push straight to Forgejo here - that
+          # bypasses GitHub as source of truth.
+          GITOPS_GITHUB_TOKEN: ${{ secrets.GITOPS_GITHUB_TOKEN }}
           SHA: ${{ github.sha }}
         run: |
           set -euo pipefail
-          test -n "${GITOPS_PAT:-}" || { echo "GITOPS_PAT is empty"; exit 1; }
+          test -n "${GITOPS_GITHUB_TOKEN:-}" || { echo "GITOPS_GITHUB_TOKEN is empty"; exit 1; }
 
           GITOPS_DIR=$(mktemp -d)
-          git clone "https://forgejo-actions:${GITOPS_PAT}@${GITOPS_SERVER}/${GITOPS_OWNER}/${GITOPS_REPO}.git" "$GITOPS_DIR"
+          git clone "https://${GITOPS_GITHUB_OWNER}:${GITOPS_GITHUB_TOKEN}@github.com/${GITOPS_GITHUB_OWNER}/${GITOPS_REPO}.git" "$GITOPS_DIR"
           cd "$GITOPS_DIR"
           git checkout "$GITOPS_BRANCH"