diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index d1f74fd..ec09bbb 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -11,9 +11,10 @@ jobs:
       - name: Checkout
         run: |
           apt-get update -qq && apt-get install -y -qq git >/dev/null
-          # Token-authenticated fetch so CI works on private repos too; internal
-          # gitea:3000 host avoids the proxy round-trip.
-          git init -q . && git fetch -q --depth 1 "http://x:${{ secrets.GITHUB_TOKEN }}@gitea:3000/${{ github.repository }}.git" "${{ github.sha }}" && git checkout -q FETCH_HEAD
+          # Token-authenticated fetch so CI also works if the repo goes private.
+          # Public hostname: job containers get their own network and cannot
+          # resolve the internal `gitea` service name.
+          git init -q . && git fetch -q --depth 1 "https://x:${{ secrets.GITHUB_TOKEN }}@git.rehbock.xyz/${{ github.repository }}.git" "${{ github.sha }}" && git checkout -q FETCH_HEAD
       - run: bun install --frozen-lockfile
       - run: bun run typecheck
       - run: bun run build:web