diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 7c4fcf4..3eb638f 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -17,6 +17,7 @@ jobs:
     env:
       GOPRIVATE: forgejo.riotpiao.com
       GOFLAGS: -mod=readonly
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       # actions/checkout is a Node-based action; golang:1.25 has no node on PATH.
       - name: install node (required by JS-based actions)
@@ -25,12 +26,12 @@ jobs:
       - uses: actions/checkout@v4
 
       # kmsvc-proto lives in another private repo on the same Forgejo instance.
-      # FORGEJO_PAT needs read access to that repo; without it `go build` 404s on go-get.
+      # GITHUB_TOKEN is auto-injected by Forgejo Actions and has read access to all repos.
       - name: configure git auth for private module fetch
         run: |
-          git config --global url."https://oauth2:${FORGEJO_PAT}@forgejo.riotpiao.com".insteadOf "https://forgejo.riotpiao.com"
+          git config --global url."https://oauth2:${GITHUB_TOKEN}@forgejo.riotpiao.com".insteadOf "https://forgejo.riotpiao.com"
         env:
-          FORGEJO_PAT: ${{ secrets.FORGEJO_PAT }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: cache go modules + build cache
         uses: actions/cache@v4
diff --git a/.gitea/workflows/release.yaml b/.gitea/workflows/release.yaml
index 9134502..367a264 100644
--- a/.gitea/workflows/release.yaml
+++ b/.gitea/workflows/release.yaml
@@ -23,9 +23,9 @@ jobs:
 
       - name: configure git auth for private module fetch
         run: |
-          git config --global url."https://oauth2:${FORGEJO_PAT}@forgejo.riotpiao.com".insteadOf "https://forgejo.riotpiao.com"
+          git config --global url."https://oauth2:${GITHUB_TOKEN}@forgejo.riotpiao.com".insteadOf "https://forgejo.riotpiao.com"
         env:
-          FORGEJO_PAT: ${{ secrets.FORGEJO_PAT }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       # A tag is the public contract for `go get ...@vX.Y.Z` — re-run the full
       # gate before publishing a release, never trust that main was green.