diff --git a/.gitea/workflows/ci-cd.yml b/.gitea/workflows/ci-cd.yml
index cfb402e..b47e844 100644
--- a/.gitea/workflows/ci-cd.yml
+++ b/.gitea/workflows/ci-cd.yml
@@ -84,14 +84,14 @@ jobs:
       - name: Checkout code
         run: |
           set -euo pipefail
-          REPO_URL=$(echo "${GITHUB_SERVER_URL}" | sed "s|://|://oauth2:${{ gitea.token }}@|")
+          REPO_URL="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}}"
-          git -c core.hooksPath=/dev/null clone --depth=1 --branch="${BRANCH}" "${REPO_URL}/${GITHUB_REPOSITORY}.git" .
+          git -c core.hooksPath=/dev/null clone --depth=1 --branch="${BRANCH}" "${REPO_URL}" .
           git -c core.hooksPath=/dev/null checkout "${GITHUB_SHA}"
 
       - name: Build and push golden images
         env:
-          GITEA_TOKEN: ${{ gitea.token }}
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
           REGISTRY_PASSWORD: ${{ secrets.REGISTRY_TOKEN }}
         run: |
@@ -109,7 +109,7 @@ jobs:
           export no_proxy="${no_proxy:-},${REGISTRY_HOST}"
 
           if [ -z "${REGISTRY_PASSWORD}" ]; then
-            echo "REGISTRY_TOKEN secret is not set and gitea.token fallback is empty" >&2
+            echo "REGISTRY_TOKEN secret is not set and GITEA_TOKEN fallback is empty" >&2
             exit 1
           fi
 
@@ -166,14 +166,14 @@ jobs:
       - name: Checkout code
         run: |
           set -euo pipefail
-          REPO_URL=$(echo "${GITHUB_SERVER_URL}" | sed "s|://|://oauth2:${{ gitea.token }}@|")
+          REPO_URL="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}}"
-          git -c core.hooksPath=/dev/null clone --depth=1 --branch="${BRANCH}" "${REPO_URL}/${GITHUB_REPOSITORY}.git" .
+          git -c core.hooksPath=/dev/null clone --depth=1 --branch="${BRANCH}" "${REPO_URL}" .
           git -c core.hooksPath=/dev/null checkout "${GITHUB_SHA}"
 
       - name: Run quality in golden image
         env:
-          GITEA_TOKEN: ${{ gitea.token }}
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
           REGISTRY_PASSWORD: ${{ secrets.REGISTRY_TOKEN }}
           SKIP_LINT: ${{ contains(github.event.head_commit.message, '#no_lint') }}
@@ -191,7 +191,7 @@ jobs:
           export no_proxy="${no_proxy:-},${REGISTRY_HOST}"
 
           if [ -z "${REGISTRY_PASSWORD}" ]; then
-            echo "REGISTRY_TOKEN secret is not set and gitea.token fallback is empty" >&2
+            echo "REGISTRY_TOKEN secret is not set and GITEA_TOKEN fallback is empty" >&2
             exit 1
           fi
 
@@ -255,9 +255,9 @@ jobs:
       - name: Checkout code
         run: |
           set -euo pipefail
-          REPO_URL=$(echo "${GITHUB_SERVER_URL}" | sed "s|://|://oauth2:${{ gitea.token }}@|")
+          REPO_URL="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}}"
-          git -c core.hooksPath=/dev/null clone --depth=1 --branch="${BRANCH}" "${REPO_URL}/${GITHUB_REPOSITORY}.git" .
+          git -c core.hooksPath=/dev/null clone --depth=1 --branch="${BRANCH}" "${REPO_URL}" .
           git -c core.hooksPath=/dev/null checkout "${GITHUB_SHA}"
 
       - name: Free Docker build space
@@ -271,7 +271,7 @@ jobs:
 
       - name: Build and push branch images
         env:
-          GITEA_TOKEN: ${{ gitea.token }}
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
           REGISTRY_PASSWORD: ${{ secrets.REGISTRY_TOKEN }}
         run: |
@@ -298,7 +298,7 @@ jobs:
           export no_proxy="${no_proxy:-},${REGISTRY_HOST}"
 
           if [ -z "${REGISTRY_PASSWORD}" ]; then
-            echo "REGISTRY_TOKEN secret is not set and gitea.token fallback is empty" >&2
+            echo "REGISTRY_TOKEN secret is not set and GITEA_TOKEN fallback is empty" >&2
             exit 1
           fi