diff --git a/modules/web01/gitea/actions-runner.nix b/modules/web01/gitea/actions-runner.nix
index edf278a..8087d50 100644
--- a/modules/web01/gitea/actions-runner.nix
+++ b/modules/web01/gitea/actions-runner.nix
@@ -69,6 +69,8 @@
     settings = {
       runner.envs = {
         HOME = "/var/lib/gitea-runner/nix";
+        # unset the token so it doesn't leak into the runner
+        TOKEN = "";
       };
     };
   };