diff --git a/kubernetes/apps/gitea/statefulset.yaml b/kubernetes/apps/gitea/statefulset.yaml
index 06634a2f..bbdeabc0 100644
--- a/kubernetes/apps/gitea/statefulset.yaml
+++ b/kubernetes/apps/gitea/statefulset.yaml
@@ -62,10 +62,18 @@ spec:
               value: "22"
             - name: GITEA__server__SSH_DOMAIN
               value: gitea.renner.uno
-            # The LXC ran as RUN_USER=gitea, so every existing remote and clone
-            # URL is gitea@gitea.renner.uno. The rootless image runs as `git`, so
-            # SSH_USER would default to `git` and reject `gitea@` logins. Pin it to
-            # `gitea` so existing remotes keep working with no client changes.
+            # The LXC ran RUN_USER=gitea, so every existing remote/clone URL is
+            # gitea@gitea.renner.uno. The rootless image runs as `git`, so the
+            # built-in SSH server would only accept `git@` and reject `gitea@`.
+            # BUILTIN_SSH_SERVER_USER is what the built-in server checks the login
+            # name against (defaults to RUN_USER=git) -> set it to `gitea` so
+            # gitea@ authenticates. SSH_USER only sets the DISPLAYED clone URL (it
+            # does NOT affect auth) -> also gitea so the UI matches. This keeps all
+            # existing gitea@ remotes working with no client changes. Trade-off:
+            # git@ no longer authenticates (single built-in login), which is fine —
+            # nothing here uses git@.
+            - name: GITEA__server__BUILTIN_SSH_SERVER_USER
+              value: gitea
             - name: GITEA__server__SSH_USER
               value: gitea
             - name: GITEA__server__DISABLE_SSH