diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 37c37ef..1e57418 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -50,13 +50,14 @@ jobs:
           RUSTC_WRAPPER: ""
 
       # compliance-agent has a git dependency on tramiton-core (a private repo on
-      # this Gitea instance). Rewrite its SSH URL to HTTPS + a read token so the
-      # runner can fetch it. Requires a repo secret TRAMITON_FETCH_TOKEN — a
-      # Gitea PAT for a user with read access to sharang/tramiton.
+      # this Gitea instance). Rewrite its SSH URL to HTTPS + the ephemeral Actions
+      # token so the runner can fetch it — no PAT needed. This works because
+      # sharang/tramiton lists sharang as a Collaborative Owner (tramiton →
+      # Settings → Actions), which lets this repo's Actions read tramiton.
       - name: Configure git auth for private tramiton dependency
         run: |
           git config --global \
-            url."https://sharang:${{ secrets.TRAMITON_FETCH_TOKEN }}@gitea.meghsakha.com/".insteadOf \
+            url."https://gitea-actions:${{ github.token }}@gitea.meghsakha.com/".insteadOf \
             "ssh://git@gitea.meghsakha.com:22222/"
         env:
           RUSTC_WRAPPER: ""