diff --git a/.gitea/workflows/demo.yaml b/.gitea/workflows/demo.yaml
index 0cd34ab..5b4a7ce 100644
--- a/.gitea/workflows/demo.yaml
+++ b/.gitea/workflows/demo.yaml
@@ -1,6 +1,12 @@
 name: demo
 on: [push]
 
+# ponytail: GIT_SSL_NO_VERIFY is here only because Traefik still serves its
+# default self-signed cert for git.kessinen.com. Remove it once the
+# LE-DNS01-cloudflare runbook has been run.
+env:
+  GIT_SSL_NO_VERIFY: "true"
+
 jobs:
   check:
     runs-on: ubuntu-latest