diff --git a/scripts/ralph_gitea_sync.py b/scripts/ralph_gitea_sync.py
index d181503..ef40317 100644
--- a/scripts/ralph_gitea_sync.py
+++ b/scripts/ralph_gitea_sync.py
@@ -31,6 +31,13 @@ STATUS_LABELS = {
 
 
 def credential_for(host: str) -> tuple[str, str]:
+    # Prefer explicitly injected process credentials for headless workers. They
+    # are never written to the repo or emitted in logs.
+    username = os.environ.get("GITEA_USERNAME")
+    password = os.environ.get("GITEA_TOKEN") or os.environ.get("GITEA_PASSWORD")
+    if password:
+        return username or "", password
+
     result = subprocess.run(
         ["git", "credential", "fill"],
         input=f"protocol=https\nhost={host}\n\n",