diff --git a/.forgejo/workflows/deploy.yml b/.forgejo/workflows/deploy.yml
index f6bcfb5..8f48cec 100644
--- a/.forgejo/workflows/deploy.yml
+++ b/.forgejo/workflows/deploy.yml
@@ -1,4 +1,4 @@
-# Deploy: build → push → nomad job run, on every push to main.
+# Deploy: build → push → nomad job run, on every push to master.
 #
 # Runner requirements (verify on the Forgejo VPS):
 #   - job container gets the docker socket (runner config must allow
@@ -36,8 +36,8 @@ jobs:
         run: |
           apk add --no-cache git
           git init -q .
-          git remote add origin ${{ gitea.server_url }}/${{ gitea.repository }}.git
-          git fetch --depth 1 origin ${{ gitea.sha }}
+          git remote add origin ${{ github.server_url }}/${{ github.repository }}.git
+          git fetch --depth 1 origin ${{ github.sha }}
           git checkout -q FETCH_HEAD
 
       - name: Extract nomad CLI (official image; CDN is blocked here)
@@ -55,7 +55,7 @@ jobs:
       - name: Build & push images (SHA tag)
         run: |
           set -e
-          TAG="${GITEA_SHA}"
+          TAG="${{ github.sha }}"
           for name in api worker-extract worker-analyze worker-prescreen worker-billing worker-notify; do
             image="$REGISTRY_HOST/$REGISTRY_OWNER/contract-check-$name"
             docker build -f "srv/$name/Dockerfile" -t "$image:$TAG" .
@@ -66,7 +66,7 @@ jobs:
         run: |
           mkdir -p /tmp/nomad-tls
           echo "${{ secrets.NOMAD_CACERT }}" > /tmp/nomad-tls/ca.crt
-          export IMAGE_TAG="${GITEA_SHA}"
+          export IMAGE_TAG="${{ github.sha }}"
           export NOMAD_ADDR="https://${{ vars.NOMAD_ADDR_HOST }}:4646"
           export NOMAD_CACERT=/tmp/nomad-tls/ca.crt
           export NOMAD_TOKEN="${{ secrets.NOMAD_TOKEN }}"