diff --git a/.github/workflows/sync-to-forgejo.yml b/.github/workflows/sync-to-forgejo.yml
index 7b46891..9fc8cef 100644
--- a/.github/workflows/sync-to-forgejo.yml
+++ b/.github/workflows/sync-to-forgejo.yml
@@ -10,14 +10,14 @@ jobs:
   sync:
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
-      - name: Sync to Forgejo
+      - name: Push branch to Forgejo
         env:
           FORGEJO_SECRET: ${{ secrets.FORGEJO_SECRET || secrets.GITEA_SECRET }}
           FORGEJO_OWNER: ${{ secrets.FORGEJO_OWNER || 'ashwin' }}
@@ -25,16 +25,16 @@ jobs:
           REPO: ${{ github.event.repository.name }}
           BRANCH: ${{ github.ref_name }}
         run: |
-          set -euxo pipefail
-          export GIT_TERMINAL_PROMPT=0
-          export GIT_TRACE=1
-          export GIT_CURL_VERBOSE=1
+          set -euo pipefail
+          test -n "${FORGEJO_SECRET:-}" || { echo "FORGEJO_SECRET is empty"; exit 1; }
 
-          USER="${FORGEJO_USERNAME}"
-          AUTH="$(printf '%s' "${USER}:${FORGEJO_SECRET}" | base64 -w0)"
+          ENCODED_PASSWORD="$(printf '%s' "${FORGEJO_SECRET}" | jq -sRr @uri)"
+          TARGET="https://${FORGEJO_USERNAME}:${ENCODED_PASSWORD}@ci.nxtgauge.com/${FORGEJO_OWNER}/${REPO}.git"
 
-          test -n "${FORGEJO_SECRET:-}" || (echo "FORGEJO_SECRET empty" && exit 1)
-          curl -fsS -H "Authorization: Basic ${AUTH}" https://ci.nxtgauge.com/api/v1/user >/dev/null
-          curl -fsS -X POST \
-            -H "Authorization: Basic ${AUTH}" \
-            "https://ci.nxtgauge.com/api/v1/repos/${FORGEJO_OWNER}/${REPO}/mirror-sync" >/dev/null
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git remote remove forgejo 2>/dev/null || true
+          git remote add forgejo "${TARGET}"
+
+          git push forgejo "HEAD:${BRANCH}" --force
+          git push forgejo --tags --force