diff --git a/.gitea/workflows/publish.yml b/.gitea/workflows/publish.yml
index 499b221d..dc3b32dd 100644
--- a/.gitea/workflows/publish.yml
+++ b/.gitea/workflows/publish.yml
@@ -20,6 +20,7 @@ jobs:
         with:
           ref: ${{ github.ref_name }}
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@v6
@@ -31,6 +32,8 @@ jobs:
           git reset --hard ${{ github.sha }}
       - name: Evaluate | Verify upstream has NOT changed
         shell: bash
+        env:
+          MX_GITEA_BOT_TOKEN: ${{ secrets.MX_GITEA_BOT_TOKEN }}
         run: |
           set +o pipefail
 
@@ -44,6 +47,11 @@ jobs:
               exit 1
           fi
 
+          # checkout ran with persist-credentials: false, so the remote carries no
+          # credentials; give it the bot token to reach this private repo.
+          git remote set-url "${UPSTREAM_BRANCH_NAME%%/*}" \
+            "https://${MX_GITEA_BOT_TOKEN}@gitea.psi.ch/${{ github.repository }}.git"
+
           git fetch "${UPSTREAM_BRANCH_NAME%%/*}"
 
           if ! UPSTREAM_SHA="$(git rev-parse "$UPSTREAM_BRANCH_NAME")"; then