diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 8bc9a64..ac3e961 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -27,4 +27,5 @@ jobs:
       - name: Deploy
         env:
           DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
         run: php deployer.phar deploy production -vvv
diff --git a/deploy.php b/deploy.php
index caa2f88..3d50ecc 100644
--- a/deploy.php
+++ b/deploy.php
@@ -3,7 +3,9 @@ namespace Deployer;
 
 require 'recipe/symfony.php';
 
-set('repository', 'https://git.homelab.nestor-server.fr/colgora/Mangarr.git');
+// GITEA_TOKEN injecté depuis le secret Gitea (scope: read:repository)
+$giteaToken = getenv('GITEA_TOKEN') ?: throw new \RuntimeException('GITEA_TOKEN secret is required');
+set('repository', "https://{$giteaToken}@git.homelab.nestor-server.fr/colgora/Mangarr.git");
 set('keep_releases', 3);
 set('composer_options', '--no-dev --optimize-autoloader --no-interaction --prefer-dist');