diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 15eadbe..8faeb8d 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -16,6 +16,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Build Docker image
         run: |
@@ -95,6 +96,12 @@ jobs:
             git add VERSION
             git commit -m "Bump build version to $NEW_VERSION [skip ci]"
 
+            # Belt and suspenders: actions/checkout can leave its own ephemeral
+            # credential injected as an extraheader, which would silently override
+            # the URL-embedded token below. persist-credentials:false on checkout
+            # should already prevent this, but strip it here too just in case.
+            git config --unset-all http.https://git.djeex.fr/.extraheader || true
+
             git push "https://Djeex:${{ secrets.CI_PUSH_TOKEN }}@git.djeex.fr/Djeex/adguard-cidre.git" HEAD:main
           fi