diff --git a/.forgejo/workflows/deploy.yml b/.forgejo/workflows/deploy.yml
index 0fdc5ec..763acf4 100644
--- a/.forgejo/workflows/deploy.yml
+++ b/.forgejo/workflows/deploy.yml
@@ -15,9 +15,13 @@ jobs:
           GRAYLOG_EXTERNAL_URI: http://93.171.241.5:9000/
           GRAYLOG_ADMIN_PASSWORD: ${{ secrets.GRAYLOG_ADMIN_PASSWORD }}
           DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
+          # Forgejo issues this automatically per-job, scoped to this repo only -
+          # needed once the repo is private, since a plain anonymous clone would
+          # get 401/403. No extra secret to manage: it's provided by the platform.
+          CI_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           rm -rf /tmp/graylog-deploy-ci
-          git clone --depth 1 --branch main https://git.zotac.keenetic.link/zotac/graylog-deploy.git /tmp/graylog-deploy-ci
+          git clone --depth 1 --branch main "https://x-access-token:${CI_TOKEN}@git.zotac.keenetic.link/zotac/graylog-deploy.git" /tmp/graylog-deploy-ci
           cd /tmp/graylog-deploy-ci
           chmod +x install-graylog.sh
           ./install-graylog.sh