diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 9ff5089..3daef12 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -18,6 +18,10 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          # Gitea's auto Actions-token returned 403 on the private repo checkout;
+          # use an explicit PAT (repo read) provided as the CI_TOKEN secret.
+          token: ${{ secrets.CI_TOKEN }}
 
       - name: Herstel signing keystore uit secret
         run: |