diff --git a/ansible/post-deploy.yml b/ansible/post-deploy.yml
index ca5ca75..c75b6fd 100644
--- a/ansible/post-deploy.yml
+++ b/ansible/post-deploy.yml
@@ -76,7 +76,7 @@
     - name: Ensure git public key is in gitea loaded authorized_keys
       blockinfile:
         path: /var/lib/gitea/git/.ssh/authorized_keys
-        block: "{{ git_id_rsa_pub.stdout }}"
+        block: "no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty {{ git_id_rsa_pub.stdout }}"
         state: present
         owner: git
         group: git