diff --git a/bootstrap.sh b/bootstrap.sh
index d59af58..12a7f94 100755
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -56,11 +56,12 @@ configure_gitea_creds() {
     local creds_file=$creds_dir/git-credentials
     mkdir -p "$creds_dir"
     chmod 700 "$creds_dir"
-    # Format the credential URL: protocol://user:token@host
-    # Extract host from REPO_HTTPS for the credential line.
-    local host
+    # Format the credential URL: <scheme>://user:token@host (scheme must match
+    # the actual REPO_HTTPS — git's credential helper does exact prefix match).
+    local proto host
+    proto=$(echo "$REPO_HTTPS" | sed -E 's|^(https?)://.*|\1|')
     host=$(echo "$REPO_HTTPS" | sed -E 's|^https?://([^/]+).*|\1|')
-    printf 'https://%s:%s@%s\n' "$GITEA_USER" "$GITEA_TOKEN" "$host" > "$creds_file"
+    printf '%s://%s:%s@%s\n' "$proto" "$GITEA_USER" "$GITEA_TOKEN" "$host" > "$creds_file"
     chmod 600 "$creds_file"
     # Point git at this store globally for root (so future pulls work too).
     git config --global credential.helper "store --file=$creds_file"