diff --git a/.gitea/workflows/port-to-omp.yml b/.gitea/workflows/port-to-omp.yml
index 297628c..f7b10cb 100644
--- a/.gitea/workflows/port-to-omp.yml
+++ b/.gitea/workflows/port-to-omp.yml
@@ -5,7 +5,7 @@ name: port-to-omp
 #
 # Prerequisites on git.freno.me:
 #   - an access token with write:repository scope, stored as the repo/org
-#     secret PORTING_TOKEN (the workflow authenticates as `oauth2:<token>` over
+#     secret PORTING_KEY (the workflow authenticates as `oauth2:<token>` over
 #     https)
 #   - a registered Actions runner (act_runner) for this repo
 #
@@ -34,9 +34,8 @@ jobs:
           set -euo pipefail
           # Trim the secret: a stray newline from pasting silently breaks
           # oauth2 basic-auth. Fail loudly when it is missing entirely.
-          : "${PORTING_TOKEN:?PORTING_TOKEN secret is not set}" || exit 1
-          PORTING_TOKEN="$(printf '%s' "${PORTING_TOKEN}" | tr -d '[:space:]')"
-          URL="https://oauth2:${PORTING_TOKEN}@git.freno.me/Mike/${OMP_REPO}.git"
+          : "${PORTING_KEY:?PORTING_KEY secret is not set}" || exit 1
+          URL="https://oauth2:${PORTING_KEY}@git.freno.me/Mike/${OMP_REPO}.git"
           # The omp checkout lives in $RUNNER_TEMP, outside the pi checkout:
           # the port script refuses to write into a subdirectory of its own
           # source (cpSync would recurse into itself).