diff --git a/.forgejo/workflows/gitea-upgrade.yml b/.forgejo/workflows/gitea-upgrade.yml
new file mode 100644
index 00000000..fe1bc458
--- /dev/null
+++ b/.forgejo/workflows/gitea-upgrade.yml
@@ -0,0 +1,36 @@
+#
+#
+# https://code.forgejo.org/forgejo/end-to-end/settings/actions
+#
+# secrets.MIRROR_TOKEN_GITEA
+#   https://code.forgejo.org/forgejo-mirror scope read:repository
+#
+
+on:
+  pull_request_target:
+  push:
+    branches:
+      - 'main'
+      - 'wip-gitea'
+
+jobs:
+  gitea_upgrade:
+    name: gitea upgrade
+    runs-on: lxc-bookworm
+    steps:
+      - uses: https://data.forgejo.org/actions/checkout@v4
+      - name: prepare upload
+        run: |
+          mkdir -p /tmp/forgejo-upload
+          touch /tmp/forgejo-upload/PLACEHOLDER
+      - uses: actions/upload-artifact@v3
+        with:
+          name: forgejo-dev
+          path: /tmp/forgejo-upload
+      - uses: ./.forgejo/prepare-end-to-end
+      - name: gitea upgrades
+        run: |
+            su forgejo -c "./end-to-end.sh test_gitea_upgrades ${{ secrets.MIRROR_TOKEN_GITEA }}"
+      - name: full logs
+        if: always()
+        run: su forgejo -c "./end-to-end.sh show_logs"
diff --git a/lib/lib.sh b/lib/lib.sh
index 8aac3578..abc3ead1 100644
--- a/lib/lib.sh
+++ b/lib/lib.sh
@@ -141,13 +141,15 @@ function download_forgejo() {
     fi
 }
 
+: ${GITEA_AUTHORIZATION_HEADER:=}
+
 function download_gitea() {
     local version=$1
 
     if ! test -f $DIR_BINARIES/gitea-$version; then
         mkdir -p $DIR_BINARIES
         if [[ $version =~ ^[0-9]+\.[0-9]+$ ]]; then
-            full_version=$(curl -sS "https://api.github.com/repos/go-gitea/gitea/releases?per_page=100" | jq -r '.[] | .tag_name | select(startswith("v'$version'"))' | grep -v -e '-rc' | sort --reverse --version-sort | head -1) 
+            full_version=$(curl -sS -H "$GITEA_AUTHORIZATION_HEADER" "https://code.forgejo.org/api/v1/repos/gitea/gitea/tags" | jq -r '.[] | .name | select(startswith("v'$version'"))' | grep -v -e '-rc' | sort --reverse --version-sort | head -1)
             full_version=${full_version#v}
         else
             full_version=$version
diff --git a/upgrade/upgrade.sh b/upgrade/upgrade.sh
index 3248e830..1d95156f 100755
--- a/upgrade/upgrade.sh
+++ b/upgrade/upgrade.sh
@@ -67,6 +67,11 @@ function migration_assert() {
 }
 
 function test_gitea_upgrades() {
+    local token="$1"
+    GITEA_AUTHORIZATION_HEADER="Authorization: token $token"
+
+    run dependencies
+
     local config=$UPGRADE_DIR/default-app.ini
     # The Forgejo target migration version must be 10.0 because it is the last supported.
     # https://forgejo.org/2024-12-gitea-compatibility/
@@ -104,5 +109,4 @@ function test_upgrades() {
 
     run test_successful_upgrades
     run test_forgejo_pprof
-    run test_gitea_upgrades
 }