diff --git a/services/hermes/agent-deployment.yaml b/services/hermes/agent-deployment.yaml
index b1215abc3..8ffb45ba3 100644
--- a/services/hermes/agent-deployment.yaml
+++ b/services/hermes/agent-deployment.yaml
@@ -25,7 +25,7 @@ spec:
         ai.bstein.dev/execution: Hermes Kanban with durable direct Codex and Claude Code CLI workers
         ai.bstein.dev/model-policy: Jetson-assisted AUTO routing, low through xhigh, cross-provider fallback
         ai.bstein.dev/placement: rpi5 preferred; Jetson deferred until state storage is available
-        ai.bstein.dev/config-rev: "20260813-kanban-corruption-isolation"
+        ai.bstein.dev/config-rev: "20260813-gitea-service-identity"
         vault.hashicorp.com/agent-inject: "true"
         vault.hashicorp.com/role: hermes-agent
         vault.hashicorp.com/agent-inject-secret-anthropic-token: kv/data/atlas/hermes/agent-tokens
@@ -33,12 +33,15 @@ spec:
           {{- with secret "kv/data/atlas/hermes/agent-tokens" -}}
           {{ .Data.data.anthropic_oauth_token }}
           {{- end }}
-        vault.hashicorp.com/agent-inject-secret-gitea-token: kv/data/atlas/hermes/agent-tokens
+        vault.hashicorp.com/agent-inject-secret-gitea-token: kv/data/atlas/hermes/developer-gitea
         vault.hashicorp.com/agent-inject-template-gitea-token: |
-          {{- with secret "kv/data/atlas/hermes/agent-tokens" -}}
-          {{- with index .Data.data "gitea_token" -}}
-          {{ . }}
-          {{- end -}}
+          {{- with secret "kv/data/atlas/hermes/developer-gitea" -}}
+          {{ .Data.data.token }}
+          {{- end }}
+        vault.hashicorp.com/agent-inject-secret-gitea-username: kv/data/atlas/hermes/developer-gitea
+        vault.hashicorp.com/agent-inject-template-gitea-username: |
+          {{- with secret "kv/data/atlas/hermes/developer-gitea" -}}
+          {{ .Data.data.username }}
           {{- end }}
         vault.hashicorp.com/agent-inject-secret-chat-relay-key: kv/data/atlas/hermes/chat-telegram
         vault.hashicorp.com/agent-inject-template-chat-relay-key: |
@@ -134,11 +137,14 @@ spec:
                 token="$(tr -d '\r\n' < /vault/secrets/gitea-token)"
                 case "${token}" in ""|"<no value>"|"<nil>") ;; *) upsert_env GITEA_TOKEN "${token}" ;; esac
               fi
+              if [ -s /vault/secrets/gitea-username ]; then
+                username="$(tr -d '\r\n' < /vault/secrets/gitea-username)"
+                case "${username}" in ""|"<no value>"|"<nil>") ;; *) upsert_env GITEA_USERNAME "${username}" ;; esac
+              fi
               if [ -s /vault/secrets/chat-relay-key ]; then
                 token="$(tr -d '\r\n' < /vault/secrets/chat-relay-key)"
                 [ -z "${token}" ] || upsert_env HERMES_IMAGE_BROKER_KEY "${token}"
               fi
-              upsert_env GITEA_USERNAME bstein
               upsert_env GIT_ASKPASS /opt/coordinator/gitea_askpass.sh
               upsert_env GIT_TERMINAL_PROMPT 0
               chmod 0600 "${env_file}"
diff --git a/services/hermes/scripts/gitea_askpass.sh b/services/hermes/scripts/gitea_askpass.sh
index a52635c62..f80bdc933 100755
--- a/services/hermes/scripts/gitea_askpass.sh
+++ b/services/hermes/scripts/gitea_askpass.sh
@@ -2,7 +2,7 @@
 set -eu
 
 case "${1:-}" in
-  *Username*) printf '%s\n' "${GITEA_USERNAME:-bstein}" ;;
+  *Username*) printf '%s\n' "${GITEA_USERNAME:-hermes-automation}" ;;
   *Password*) printf '%s\n' "${GITEA_TOKEN:-}" ;;
   *) exit 1 ;;
 esac