diff --git a/.gitea/workflows/deploy-stack.yml b/.gitea/workflows/deploy-stack.yml
index 377b387..cc3668e 100644
--- a/.gitea/workflows/deploy-stack.yml
+++ b/.gitea/workflows/deploy-stack.yml
@@ -67,6 +67,13 @@ on:
         required: false
         type: string
         default: ""
+    secrets:
+      RUNNER_REPO_PAT:
+        description: |
+          PAT used in the absolute-URL form of `uses:` to clone composite actions
+          from `Charlie/project-charlie`. Set as a Charlie org-level secret;
+          callers pass via `secrets: inherit` (or explicitly).
+        required: true
 
 jobs:
   deploy: