diff --git a/ops/infra/kubernetes/cgit/config.yaml b/ops/infra/kubernetes/cgit/config.yaml
index 43bfe9d7f..73392adaa 100644
--- a/ops/infra/kubernetes/cgit/config.yaml
+++ b/ops/infra/kubernetes/cgit/config.yaml
@@ -8,6 +8,8 @@ data:
   username: "Z2l0LXRhemppbi5nbWFpbC5jb20="
   # This credential is a GCSR 'gitcookie' token.
   password: '{{ passLookup "gcsr-tazjin-password" | b64enc }}'
+  # This credential is an OAuth token for builds.sr.ht
+  sourcehut: '{{ passLookup "sr.ht-token" | b64enc }}'
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -16,7 +18,7 @@ metadata:
   labels:
     app: cgit
 spec:
-  replicas: 2
+  replicas: 1
   selector:
     matchLabels:
       app: cgit
@@ -53,6 +55,11 @@ spec:
               secretKeyRef:
                 name: gcsr-secrets
                 key: password
+          - name: SRHT_TOKEN
+            valueFrom:
+              secretKeyRef:
+                name: gcsr-secrets
+                key: sourcehut
         volumeMounts:
           - name: git-volume
             mountPath: /git
diff --git a/ops/secrets/sr.ht-token b/ops/secrets/sr.ht-token
new file mode 100644
index 000000000..53eb0d16b
Binary files /dev/null and b/ops/secrets/sr.ht-token differ