diff --git a/.forgejo/workflows/macos.yml b/.forgejo/workflows/macos.yml
index b0824e3..7aad994 100644
--- a/.forgejo/workflows/macos.yml
+++ b/.forgejo/workflows/macos.yml
@@ -11,4 +11,12 @@ jobs:
     runs-on: macos-arm64
     steps:
       - uses: https://code.forgejo.org/actions/checkout@v4
+      # Forgejo auto-injects GITHUB_TOKEN (GH Actions compatibility), scoped
+      # to this Forgejo instance. Nix auto-detects that env var and assumes
+      # it's a github.com credential, so it sends it to api.github.com when
+      # fetching nixpkgs tarballs for devbox - which rejects it with 401.
+      # Clearing it here falls back to unauthenticated (fine for public
+      # nixpkgs fetches, same as this succeeds locally with no token set).
       - run: devbox run check
+        env:
+          GITHUB_TOKEN: ""