diff --git a/.gitea/workflows/gateway.yml b/.gitea/workflows/gateway.yml
index ef49c38..ebe2471 100644
--- a/.gitea/workflows/gateway.yml
+++ b/.gitea/workflows/gateway.yml
@@ -5,7 +5,8 @@ name: Gateway
 # Watchtower's nightly pull there is the fallback when the deploy trigger fails.
 #
 # Uses the user-level secrets REGISTRY_USER and REGISTRY_PASSWORD, and the repo secret
-# DEPLOY_SSH_KEY_HOME, a key that server-gib only accepts for ~/Server/ci-deploy.sh.
+# DEPLOY_SSH_KEY_HOME_B64, a base64 encoded key that server-gib only accepts for
+# ~/Server/ci-deploy.sh.
 
 on:
   push:
@@ -78,13 +79,13 @@ jobs:
           docker push "$IMAGE:latest"
 
       - name: Deploy
-        # The key comes in through env, not ${{ secrets.* }} in the script: the runner prints the
-        # script, and Gitea does not mask a multi-line secret split across lines.
+        # The secret is the private key base64 encoded on one line. The runner prints each step's
+        # env, and Gitea only masks a secret it can match in full, which a multi-line key defeats.
         env:
-          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY_HOME }}
+          DEPLOY_SSH_KEY_B64: ${{ secrets.DEPLOY_SSH_KEY_HOME_B64 }}
         run: |
           install -m600 /dev/null "$HOME/.deploy_key"
-          printf '%s\n' "$DEPLOY_SSH_KEY" > "$HOME/.deploy_key"
+          printf '%s' "$DEPLOY_SSH_KEY_B64" | base64 -d > "$HOME/.deploy_key"
           ssh -i "$HOME/.deploy_key" \
               -o BatchMode=yes \
               -o StrictHostKeyChecking=accept-new \