diff --git a/.gitea/workflows/terraform.yml b/.gitea/workflows/terraform.yml
index a88de1f..f6fcbca 100644
--- a/.gitea/workflows/terraform.yml
+++ b/.gitea/workflows/terraform.yml
@@ -97,7 +97,7 @@ jobs:
           fi
       - name: Configure module registry auth
         run: |
-          git config --global url."https://${GITLAB_MODULE_TOKEN}@gitlab.sarex.io/".insteadOf "ssh://git@gitlab.sarex.io/"
+          git config --global url."https://gitlab-module-pull:${GITLAB_MODULE_TOKEN}@gitlab.sarex.io/".insteadOf "ssh://git@gitlab.sarex.io/"
       - name: Decrypt secret values
         # SOPS_AGE_KEY only reaches this step, not the whole job - the rest
         # (checkout, kubeconfig, terragrunt run) never sees it.
@@ -158,7 +158,7 @@ jobs:
           fi
       - name: Configure module registry auth
         run: |
-          git config --global url."https://${GITLAB_MODULE_TOKEN}@gitlab.sarex.io/".insteadOf "ssh://git@gitlab.sarex.io/"
+          git config --global url."https://gitlab-module-pull:${GITLAB_MODULE_TOKEN}@gitlab.sarex.io/".insteadOf "ssh://git@gitlab.sarex.io/"
       - name: Decrypt secret values
         # SOPS_AGE_KEY only reaches this step, not the whole job - the rest
         # (checkout, kubeconfig, terragrunt run) never sees it.
@@ -220,7 +220,7 @@ jobs:
           fi
       - name: Configure module registry auth
         run: |
-          git config --global url."https://${GITLAB_MODULE_TOKEN}@gitlab.sarex.io/".insteadOf "ssh://git@gitlab.sarex.io/"
+          git config --global url."https://gitlab-module-pull:${GITLAB_MODULE_TOKEN}@gitlab.sarex.io/".insteadOf "ssh://git@gitlab.sarex.io/"
       - name: Decrypt secret values
         # SOPS_AGE_KEY only reaches this step, not the whole job - the rest
         # (checkout, kubeconfig, terragrunt run) never sees it.