diff --git a/servers/legion/k8s/gitea-runner/git-ssh-init.sh b/servers/legion/k8s/gitea-runner/git-ssh-init.sh
index 2018dbe..061dcf2 100644
--- a/servers/legion/k8s/gitea-runner/git-ssh-init.sh
+++ b/servers/legion/k8s/gitea-runner/git-ssh-init.sh
@@ -40,9 +40,9 @@ EOF
     # Point SSH at our per-job config (merge with any existing config if present)
     export GIT_SSH_COMMAND="ssh -F ~/.ssh/gitea_config"
 
-    # Rewrite HTTPS Gitea URLs → SSH so `actions/checkout` and plain `git clone`
-    # both go through SSH without any HTTPS credential or CF Access token needed
-    git config --global \
-        url."git@git.neuralplatform.ai:".insteadOf \
-        "https://git.neuralplatform.ai/" 2>/dev/null || true
+    # NOTE: Do NOT add url.insteadOf SSH rewrite here.
+    # Gitea's built-in SSH server is disabled (START_SSH_SERVER=false) so
+    # SSH git clones would fail. HTTPS git operations work directly from
+    # the build container host network — Cloudflare bypasses the CF Access
+    # gate for git smart-HTTP and release asset paths.
 fi