diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index ba580d9..86b0a8b 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -58,6 +58,10 @@ jobs:
           KANIDM_URL=${{ vars.KANIDM_URL }}
           OAUTH2_CLIENT_ID=${{ vars.OAUTH2_CLIENT_ID }}
           OAUTH2_CLIENT_SECRET=${{ secrets.OAUTH2_CLIENT_SECRET }}
+          # Onboarding from a desk (portal 0.3.40+, `invite:` alternatives): a
+          # Kanidm service-account token in idm_people_on_boarding. Empty
+          # means invites are not configured on this instance.
+          KANIDM_API_TOKEN=${{ secrets.KANIDM_API_TOKEN }}
           PUBLIC_URL=${{ vars.PUBLIC_URL }}
           COOKIE_SECURE=true
           # This repo is its own instance's content source.