diff --git a/.forgejo/workflows/deploy.yml b/.forgejo/workflows/deploy.yml
index 2c2246f..b735781 100644
--- a/.forgejo/workflows/deploy.yml
+++ b/.forgejo/workflows/deploy.yml
@@ -73,6 +73,10 @@ jobs:
           [ -n "$NOMAD_TOKEN" ]     || { echo "NOMAD_TOKEN secret is empty"; exit 1; }
           [ -n "$NOMAD_CACERT" ]    || { echo "NOMAD_CACERT secret is empty"; exit 1; }
 
+          # strip CR/LF/whitespace introduced when pasting into Forgejo UI
+          NOMAD_TOKEN=$(printf '%s' "$NOMAD_TOKEN" | tr -d '\r\n[:space:]')
+          NOMAD_ADDR_HOST=$(printf '%s' "$NOMAD_ADDR_HOST" | tr -d '\r\n[:space:]')
+
           mkdir -p .ci-tls
           printf '%s\n' "$NOMAD_CACERT" > .ci-tls/ca.crt