diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index 736388b..b7f07cd 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -52,6 +52,9 @@ jobs:
             quay.io/buildah/stable:latest \
             bash -c '
               set -euo pipefail
+              # Secrets pasted with stray whitespace/newlines break registry auth
+              RUSER="$(printf "%s" "$RUSER" | tr -d " \r\n")"
+              RTOKEN="$(printf "%s" "$RTOKEN" | tr -d " \r\n")"
               # Use the fast kernel overlay driver instead of fuse-overlayfs
               # (we are privileged, so this works — and is ~50x faster on
               # the millions of small files in the OSTree base)