diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 1e57418..0bfebf3 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -50,17 +50,19 @@ jobs:
           RUSTC_WRAPPER: ""
 
       # compliance-agent has a git dependency on tramiton-core (a private repo on
-      # this Gitea instance). Rewrite its SSH URL to HTTPS + the ephemeral Actions
-      # token so the runner can fetch it — no PAT needed. This works because
-      # sharang/tramiton lists sharang as a Collaborative Owner (tramiton →
-      # Settings → Actions), which lets this repo's Actions read tramiton.
+      # this Gitea instance). Rewrite its SSH URL to HTTPS and authenticate with
+      # the ephemeral Actions token using the same Basic-auth extraheader form
+      # that actions/checkout uses (username `x-access-token`) — no PAT needed,
+      # provided sharang/tramiton grants this repo access via Collaborative Owners
+      # (tramiton → Settings → Actions).
       - name: Configure git auth for private tramiton dependency
-        run: |
-          git config --global \
-            url."https://gitea-actions:${{ github.token }}@gitea.meghsakha.com/".insteadOf \
-            "ssh://git@gitea.meghsakha.com:22222/"
         env:
+          GITEA_ACTIONS_TOKEN: ${{ github.token }}
           RUSTC_WRAPPER: ""
+        run: |
+          AUTH=$(printf 'x-access-token:%s' "$GITEA_ACTIONS_TOKEN" | base64 -w0)
+          git config --global http."https://gitea.meghsakha.com/".extraheader "Authorization: Basic $AUTH"
+          git config --global url."https://gitea.meghsakha.com/".insteadOf "ssh://git@gitea.meghsakha.com:22222/"
 
       # Format (no compilation needed)
       - name: Format