diff --git a/deploy/ctao-demo-gitea.container b/deploy/ctao-demo-gitea.container
index 03e476c..afaea50 100644
--- a/deploy/ctao-demo-gitea.container
+++ b/deploy/ctao-demo-gitea.container
@@ -42,10 +42,13 @@ Environment=GITEA__repository__DEFAULT_PRIVATE=public
 # Push-created repos have their OWN default (true = private) — learned the hard way:
 Environment=GITEA__repository__DEFAULT_PUSH_CREATE_PRIVATE=false
 # Sveltia is served from the portal vhost and calls the Gitea API cross-origin
-# — CORS locked to exactly that origin.
+# — CORS locked to exactly that origin. ALLOW_DOMAIN takes FULL origins with
+# scheme (verified in the 1.27 config cheat sheet; a SCHEME key no longer
+# exists). Authorization must be listed in HEADERS — the default set
+# (Content-Type,User-Agent) would block Sveltia's authenticated API calls.
 Environment=GITEA__cors__ENABLED=true
-Environment=GITEA__cors__SCHEME=https
-Environment=GITEA__cors__ALLOW_DOMAIN=astro.isl-dev.grid.cyfronet.pl
+Environment=GITEA__cors__ALLOW_DOMAIN=https://astro.isl-dev.grid.cyfronet.pl
+Environment=GITEA__cors__HEADERS=Authorization,Content-Type,User-Agent
 Environment=GITEA__cors__METHODS=GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS
 
 [Service]