diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index b4dc45a..7c6153e 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -32,9 +32,9 @@ jobs:
       # path to trust in the first place.
       - name: checkout
         env:
-          GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
         run: |
-          url=$(echo "${GITHUB_SERVER_URL}" | sed -E "s#(https?://)#\1x-access-token:${GIT_TOKEN}@#")
+          url=$(echo "${GITHUB_SERVER_URL}" | sed -E "s#(https?://)#\1x-access-token:${REGISTRY_PAT}@#")
           git clone "${url}/${GITHUB_REPOSITORY}.git" .
           git checkout "${GITHUB_SHA}"
 
@@ -53,9 +53,9 @@ jobs:
       # Same reason as the buf job: golang:1.25 has no Node.js either.
       - name: checkout
         env:
-          GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
         run: |
-          url=$(echo "${GITHUB_SERVER_URL}" | sed -E "s#(https?://)#\1x-access-token:${GIT_TOKEN}@#")
+          url=$(echo "${GITHUB_SERVER_URL}" | sed -E "s#(https?://)#\1x-access-token:${REGISTRY_PAT}@#")
           git clone "${url}/${GITHUB_REPOSITORY}.git" .
           git checkout "${GITHUB_SHA}"