diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 3883cdd..0496c95 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -50,23 +50,17 @@ jobs:
           RUSTC_WRAPPER: ""
 
       # compliance-agent has a git dependency on tramiton-core (a private repo on
-      # this Gitea instance). The ephemeral Actions token can NOT clone it even
-      # with a Collaborative Owner grant (that only covers `uses:` actions), and
-      # Gitea PATs can't be scoped to a single repo. So use a read-only Deploy
-      # Key (per-repo): add the public key to sharang/tramiton → Settings →
-      # Deploy Keys (read-only), and the matching private key as this repo's
-      # TRAMITON_DEPLOY_KEY secret. cargo fetches the dep over SSH using it.
-      - name: Configure SSH deploy key for private tramiton dependency
-        env:
-          TRAMITON_DEPLOY_KEY: ${{ secrets.TRAMITON_DEPLOY_KEY }}
-          RUSTC_WRAPPER: ""
+      # this Gitea instance). Rewrite its SSH URL to HTTPS + a PAT so the runner
+      # can fetch it. Requires the repo secret TRAMITON_FETCH_TOKEN (a Gitea PAT
+      # with read:repository, owned by a user with access to sharang/tramiton).
+      # (Honored on fetch because CARGO_NET_GIT_FETCH_WITH_CLI=true uses system git.)
+      - name: Configure git auth for private tramiton dependency
         run: |
-          apt-get update && apt-get install -y --no-install-recommends openssh-client
-          mkdir -p ~/.ssh && chmod 700 ~/.ssh
-          printf '%s\n' "$TRAMITON_DEPLOY_KEY" > ~/.ssh/tramiton_ci
-          chmod 600 ~/.ssh/tramiton_ci
-          printf 'Host gitea.meghsakha.com\n  HostName gitea.meghsakha.com\n  Port 22222\n  User git\n  IdentityFile ~/.ssh/tramiton_ci\n  IdentitiesOnly yes\n  StrictHostKeyChecking accept-new\n' > ~/.ssh/config
-          chmod 600 ~/.ssh/config
+          git config --global \
+            url."https://sharang:${{ secrets.TRAMITON_FETCH_TOKEN }}@gitea.meghsakha.com/".insteadOf \
+            "ssh://git@gitea.meghsakha.com:22222/"
+        env:
+          RUSTC_WRAPPER: ""
 
       # Format (no compilation needed)
       - name: Format