diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 52a026a..4bb6ae1 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -81,6 +81,11 @@ jobs:
           # in the right place for /pkg/*.
           LEPTOS_SITE_ROOT=site
           AUTOMATION_READ_TOKEN=${{ secrets.PORTAL_AUTOMATION_READ_TOKEN }}
+          # Read-only (read:user,read:repository,read:organization),
+          # used only by the GiteaStarred/GiteaOrgRepos resource sources
+          # (src/resource.rs) - the repo-contents/repo-info calls
+          # content loading already makes stay anonymous.
+          GITEA_API_TOKEN=${{ secrets.PORTAL_GITEA_API_TOKEN }}
           EOF
 
       # No sudo: the runner's own unit sets NoNewPrivileges=yes, which