diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index d9eefb2..cc14b29 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -27,10 +27,15 @@ jobs:
       # (docker:27-cli, from the k8s-arm64 runner label) has no Node.js, so JS
       # actions fail with "exec: node: not found". Plain git needs only what the
       # image already has (git + docker) and avoids pulling a heavy act image.
+      # Pass secrets via env (NOT inline ${{ }}): a secret value pasted into the
+      # shell is re-parsed, so any $ in it expands. The Harbor robot user is
+      # robot$homelab+ci — inline it would become robot+ci ("$homelab" → empty).
       - name: Checkout
+        env:
+          FJ_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
         run: |
           git clone -q -b "${GITHUB_REF_NAME:-main}" \
-            "http://ci:${{ secrets.FORGEJO_TOKEN }}@forgejo.forgejo.svc/${{ github.repository }}.git" .
+            "http://ci:${FJ_TOKEN}@forgejo.forgejo.svc/${{ github.repository }}.git" .
 
       - name: Short SHA
         id: sha
@@ -38,9 +43,10 @@ jobs:
         run: echo "value=$(printf '%s' "$GITHUB_SHA" | cut -c1-7)" >> "$GITHUB_OUTPUT"
 
       - name: Login to Harbor
-        run: |
-          echo "${{ secrets.HARBOR_ROBOT_PASSWORD }}" \
-            | docker login harbor.devroadmap.ru -u "${{ secrets.HARBOR_ROBOT_USER }}" --password-stdin
+        env:
+          RU: ${{ secrets.HARBOR_ROBOT_USER }}       # robot$homelab+ci — via env so $ isn't expanded
+          RP: ${{ secrets.HARBOR_ROBOT_PASSWORD }}
+        run: echo "$RP" | docker login harbor.devroadmap.ru -u "$RU" --password-stdin
 
       - name: Build and push (native arm64)
         run: |
@@ -53,13 +59,15 @@ jobs:
           docker push "$IMAGE:latest"
 
       - name: Bump deploy tag (GitOps) and push back
+        env:
+          FJ_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
         run: |
           sed -i "s#newTag:.*#newTag: \"${{ steps.sha.outputs.value }}\"#" deploy/kustomization.yaml
           git config user.name "forgejo-ci"
           git config user.email "ci@git.devroadmap.ru"
           git add deploy/kustomization.yaml
           git commit -m "ci: deploy ${{ steps.sha.outputs.value }} [skip ci]" || { echo "no change"; exit 0; }
-          git push "http://ci:${{ secrets.FORGEJO_TOKEN }}@forgejo.forgejo.svc/${{ github.repository }}.git" HEAD:main
+          git push "http://ci:${FJ_TOKEN}@forgejo.forgejo.svc/${{ github.repository }}.git" HEAD:main
 
       - name: Summary
         run: |