diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index c03216d..5d5f1ec 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -19,19 +19,16 @@ jobs:
       GOFLAGS: -mod=readonly
       REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
     steps:
-      # actions/checkout is a Node-based action; golang:1.25 has no node on PATH.
+      # actions/checkout is a Node-based action; install node for Actions support.
       - name: install node (required by JS-based actions)
         run: apt-get update && apt-get install -y --no-install-recommends nodejs ca-certificates git
 
       - uses: actions/checkout@v4
 
       # kmsvc-proto lives in another private repo on the same Forgejo instance.
-      # GITHUB_TOKEN is auto-injected by Forgejo Actions and has read access to all repos.
       - name: configure git auth for private module fetch
         run: |
           git config --global url."https://oauth2:${REGISTRY_PAT}@forgejo.riotpiao.com".insteadOf "https://forgejo.riotpiao.com"
-        env:
-          REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
 
       - name: gofmt
         run: |
@@ -56,6 +53,6 @@ jobs:
 
       - name: upload coverage
         uses: actions/upload-artifact@v4
-        # with:
+        with:
           name: coverage
           path: coverage.out