diff --git a/.gitea/workflows/deploy-stack.yml b/.gitea/workflows/deploy-stack.yml
index c98dede..377b387 100644
--- a/.gitea/workflows/deploy-stack.yml
+++ b/.gitea/workflows/deploy-stack.yml
@@ -111,7 +111,10 @@ jobs:
 
       - name: Decrypt SOPS secrets
         if: ${{ inputs.decrypt != '' }}
-        uses: Charlie/project-charlie/.gitea/actions/sops-decrypt@main
+        # Absolute URL form (with auth) is required so act doesn't default to
+        # github.com. Same pattern as the caller's `uses:` for this workflow.
+        # See https://github.com/go-gitea/gitea/issues/25929.
+        uses: https://sys-gitea-runner:${{ secrets.RUNNER_REPO_PAT }}@gitea.alexandru.macocian.me/Charlie/project-charlie/.gitea/actions/sops-decrypt@main
         with:
           decrypt: ${{ inputs.decrypt }}
           workdir: ${{ steps.resolve.outputs.path }}