diff --git a/.forgejo/workflows/check.yaml b/.forgejo/workflows/check.yaml
index cfd8a76..f07c14a 100644
--- a/.forgejo/workflows/check.yaml
+++ b/.forgejo/workflows/check.yaml
@@ -22,7 +22,9 @@ jobs:
       - name: check
         run: |
           git init
-          git fetch --depth=1 "https://oauth2:$FORGEJO_TOKEN@${FORGEJO_SERVER_URL#https://}/$FORGEJO_REPOSITORY.git" "$FORGEJO_REF"
+          printf 'machine %s login oauth2 password %s\n' "${FORGEJO_SERVER_URL#https://}" "$FORGEJO_TOKEN" > ~/.netrc
+          chmod 600 ~/.netrc
+          git fetch --depth=1 "$FORGEJO_SERVER_URL/$FORGEJO_REPOSITORY.git" "$FORGEJO_REF"
           git checkout --detach FETCH_HEAD
           node --test tests/pkjs.test.js
           /root/.local/bin/pebble build
diff --git a/.forgejo/workflows/release.yaml b/.forgejo/workflows/release.yaml
index ae0e0bf..6ca5b23 100644
--- a/.forgejo/workflows/release.yaml
+++ b/.forgejo/workflows/release.yaml
@@ -22,7 +22,9 @@ jobs:
       - name: build
         run: |
           git init
-          git fetch --depth=1 "https://oauth2:$FORGEJO_TOKEN@${FORGEJO_SERVER_URL#https://}/$FORGEJO_REPOSITORY.git" "$FORGEJO_REF"
+          printf 'machine %s login oauth2 password %s\n' "${FORGEJO_SERVER_URL#https://}" "$FORGEJO_TOKEN" > ~/.netrc
+          chmod 600 ~/.netrc
+          git fetch --depth=1 "$FORGEJO_SERVER_URL/$FORGEJO_REPOSITORY.git" "$FORGEJO_REF"
           git checkout --detach FETCH_HEAD
           node --test tests/pkjs.test.js
           /root/.local/bin/pebble build
diff --git a/server/.forgejo/workflows/check.yaml b/server/.forgejo/workflows/check.yaml
index 5a5ba6c..000cef4 100644
--- a/server/.forgejo/workflows/check.yaml
+++ b/server/.forgejo/workflows/check.yaml
@@ -23,7 +23,9 @@ jobs:
       - name: check
         run: |
           git init
-          git fetch --depth=1 "https://oauth2:$FORGEJO_TOKEN@${FORGEJO_SERVER_URL#https://}/$FORGEJO_REPOSITORY.git" "$FORGEJO_REF"
+          printf 'machine %s login oauth2 password %s\n' "${FORGEJO_SERVER_URL#https://}" "$FORGEJO_TOKEN" > ~/.netrc
+          chmod 600 ~/.netrc
+          git fetch --depth=1 "$FORGEJO_SERVER_URL/$FORGEJO_REPOSITORY.git" "$FORGEJO_REF"
           git checkout --detach FETCH_HEAD
           nix flake check --no-build --system x86_64-linux
           nix develop --command cargo test --locked