diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index b603734..65c745d 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -33,6 +33,15 @@ jobs:
     defaults:
       run:
         shell: sh
+    env:
+      # Gitea auto-generates a per-job `secrets.GITHUB_TOKEN` (read-scoped
+      # to this repo) for compat with GitHub Actions, but act_runner does
+      # NOT auto-export it as an env var — referencing it explicitly here
+      # makes it available to the Checkout step's `git fetch`. Same role
+      # as `secrets.RUNNER_REPO_PAT` / `CALLER_REPO_PAT` in the Charlie
+      # deploy/build workflows, except we don't need a long-lived PAT —
+      # the per-job token is enough for a one-shot fetch.
+      GITHUB_TOKEN: ${{ github.token }}
     steps:
       - name: Install Go and curl
         run: |