diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index b68bf28..24beed0 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -10,6 +10,15 @@ jobs:
     name: Linux AppImage
     runs-on: ubuntu-latest
 
+    env:
+      # Public-facing repo URL for assets users will download.
+      # `github.server_url` resolves to the runner's internal Gitea
+      # endpoint (e.g. http://gitea:3000), which works for API calls
+      # the runner makes itself but not for URLs baked into latest.json
+      # or the AppImage's embedded --update-info — those are read by
+      # end-user machines that can only reach Gitea via its public URL.
+      PUBLIC_REPO_URL: 'https://src.bundespruefstelle.ch/magdev/php-qml'
+
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -64,7 +73,7 @@ jobs:
           # AppImageUpdate sidecar will fetch this .zsync URL; it must
           # point at the asset we're about to upload to this Release.
           APPIMAGE_UPDATE_INFO: |
-            zsync|${{ github.server_url }}/${{ github.repository }}/releases/download/${{ github.ref_name }}/Todo-x86_64.AppImage.zsync
+            zsync|${{ env.PUBLIC_REPO_URL }}/releases/download/${{ github.ref_name }}/Todo-x86_64.AppImage.zsync
         run: make appimage
 
       - name: Install zsync + Xvfb
@@ -103,7 +112,7 @@ jobs:
         run: |
           SIZE=$(stat -c %s Todo-x86_64.AppImage)
           SHA=$(sha256sum Todo-x86_64.AppImage | awk '{print $1}')
-          URL_BASE="${{ github.server_url }}/${{ github.repository }}/releases/download/${TAG}"
+          URL_BASE="${PUBLIC_REPO_URL}/releases/download/${TAG}"
           jq -n \
             --arg version "$TAG" \
             --arg url     "$URL_BASE/Todo-x86_64.AppImage" \