diff --git a/ci/github_actions/fetch_lfs.sh b/ci/github_actions/fetch_lfs.sh
index 6e5942556c..9b9bb3a7a7 100755
--- a/ci/github_actions/fetch_lfs.sh
+++ b/ci/github_actions/fetch_lfs.sh
@@ -17,6 +17,14 @@ export PATH="${COMMON_PATHS}:${PATH}"
 MAX_ATTEMPTS=5
 RETRY_DELAY=15
 GITEA_LFS_URL="https://gitea.eagle0.net/admin/eagle0-lfs.git/info/lfs"
+GITEA_CREDENTIAL_FILE=""
+
+cleanup() {
+    if [ -n "$GITEA_CREDENTIAL_FILE" ]; then
+        rm -f -- "$GITEA_CREDENTIAL_FILE"
+    fi
+}
+trap cleanup EXIT
 
 if [ -n "${GITHUB_PATH:-}" ]; then
     for path in /opt/homebrew/bin /usr/local/bin; do
@@ -46,6 +54,7 @@ git lfs ls-files | wc -l
 
 GITEA_LFS_PULL=()
 FALLBACK_GITHUB_LFS_PULL=()
+GITEA_CREDENTIAL_CONFIG=()
 GITEA_LFS_STORAGE_CONFIG=()
 
 if [ "${GITEA_LFS_VERIFY_FRESH:-}" = "true" ]; then
@@ -71,10 +80,21 @@ elif [ -n "${GITEA_LFS_TOKEN:-}" ]; then
 fi
 
 if [ -n "${GITEA_LFS_USERNAME:-}" ]; then
-    GITEA_BASIC_AUTH=$(printf '%s:%s' "$GITEA_LFS_USERNAME" "$GITEA_LFS_TOKEN" | base64 | tr -d '\n')
+    GITEA_CREDENTIAL_FILE=$(mktemp "${RUNNER_TEMP:-/tmp}/gitea-lfs-credentials.XXXXXX")
+    chmod 600 "$GITEA_CREDENTIAL_FILE"
+    git credential-store --file="$GITEA_CREDENTIAL_FILE" store <<EOF
+protocol=https
+host=gitea.eagle0.net
+username=$GITEA_LFS_USERNAME
+password=$GITEA_LFS_TOKEN
+EOF
+    GITEA_CREDENTIAL_CONFIG=(
+        -c "credential.helper="
+        -c "credential.helper=store --file=$GITEA_CREDENTIAL_FILE"
+    )
     GITEA_LFS_PULL=(
         git
-        -c "http.https://gitea.eagle0.net/.extraheader=AUTHORIZATION: basic $GITEA_BASIC_AUTH"
+        "${GITEA_CREDENTIAL_CONFIG[@]}"
         -c "lfs.url=$GITEA_LFS_URL"
         "${GITEA_LFS_STORAGE_CONFIG[@]}"
         lfs
@@ -125,6 +145,11 @@ if [ "${GITEA_LFS_VERIFY_FRESH:-}" = "true" ]; then
     fi
 fi
 
+if [ "${GITEA_LFS_VERIFY_FRESH:-}" = "true" ]; then
+    echo "Fresh Gitea LFS verification failed; GitHub fallback is disabled"
+    exit 1
+fi
+
 if [ "${#FALLBACK_GITHUB_LFS_PULL[@]}" -gt 0 ]; then
     echo "Trying temporary GitHub LFS fallback"
     if "${FALLBACK_GITHUB_LFS_PULL[@]}" "$@"; then