diff --git a/scripts/recipe-mirror-sync.sh b/scripts/recipe-mirror-sync.sh
index 2f3baf8..1f1182a 100755
--- a/scripts/recipe-mirror-sync.sh
+++ b/scripts/recipe-mirror-sync.sh
@@ -36,7 +36,10 @@ RECIPE_DIR="${HOME}/.abra/recipes/${RECIPE}"
 }
 TOKEN="$(tr -d '[:space:]' <"${TOKEN_FILE}")"
 API="https://${GITEA_HOST}/api/v1"
-MIRROR_PUSH="https://oauth2:${TOKEN}@${GITEA_HOST}/${NAMESPACE}/${RECIPE}.git"
+# Push over SSH (git@:2222, key in ~/.ssh) so no credential is ever written into the recipe
+# clone's .git/config — that config gets copytree'd into the world-readable per-run tree
+# (CCCI_SKIP_FETCH staging), which previously leaked the token. API still uses the token below.
+MIRROR_PUSH="git@${GITEA_HOST}:${NAMESPACE}/${RECIPE}.git"
 auth=(-H "Authorization: token ${TOKEN}")
 
 # Ensure the recipe is cloned (abra recipe fetch clones from the catalogue → upstream).