diff --git a/docker-compose.yml b/docker-compose.yml
index 30193b1..55952ee 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -50,7 +50,10 @@ services:
       - auth-proxy-keys:/data
 
   forgejo:
-    image: codeberg.org/forgejo/forgejo:10
+    # Small extension of the official image that adds the Silent Mode CA cert
+    # (Argonautica root) to the OS trust store, so Forgejo's Go client can
+    # validate hephaestus.x's cert on OIDC-discovery calls.
+    build: ./forgejo
     restart: unless-stopped
     environment:
       USER_UID: "1000"
@@ -107,6 +110,11 @@ services:
       FORGEJO__oauth2_client__UPDATE_AVATAR: "false"
       # Skip the web installer wizard — everything is already configured
       FORGEJO__server__INSTALL_LOCK: "true"
+    # hephaestus.x isn't in ICANN DNS, so the Forgejo container can't resolve
+    # it via its default resolver. Map it to the host gateway so OIDC-discovery
+    # calls (Forgejo → https://hephaestus.x/auth/…) reach Caddy on the host.
+    extra_hosts:
+      - "hephaestus.x:host-gateway"
     # Caddy proxies / → forgejo:3000 over the internal network. No public HTTP port.
     # 22 stays on 2222 for git-over-SSH (no TLS involved).
     expose:
diff --git a/forgejo/Dockerfile b/forgejo/Dockerfile
new file mode 100644
index 0000000..bf6e7b9
--- /dev/null
+++ b/forgejo/Dockerfile
@@ -0,0 +1,10 @@
+# Forgejo + Silent Mode CA cert baked into the trust store, so Forgejo's Go
+# client can validate hephaestus.x's cert (issued by Argonautica) when it
+# fetches OIDC discovery from https://hephaestus.x/auth/.well-known/... .
+#
+# Do NOT switch to USER git at the end — parent image's s6-overlay init needs
+# to start as root (it drops to `git` internally). USER git broke s6-svscan
+# with "unable to open .s6-svscan/lock: Permission denied".
+FROM codeberg.org/forgejo/forgejo:10
+COPY silent-mode-ca.crt /usr/local/share/ca-certificates/silent-mode-ca.crt
+RUN update-ca-certificates
diff --git a/forgejo/silent-mode-ca.crt b/forgejo/silent-mode-ca.crt
new file mode 100644
index 0000000..123c2f4
--- /dev/null
+++ b/forgejo/silent-mode-ca.crt
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDszCCApugAwIBAgIIQnTLcHP2GA4wDQYJKoZIhvcNAQELBQAwQTEaMBgGA1UE
+AxMRQk5TIExvY2FsIFJvb3QgQ0ExIzAhBgNVBAoTGkJOUyAoLmJjaCBvbiBCaXRj
+b2luIENhc2gpMB4XDTI2MDgyMTAwMDEwNVoXDTM2MDgyMTAwMDEwNVowQTEaMBgG
+A1UEAxMRQk5TIExvY2FsIFJvb3QgQ0ExIzAhBgNVBAoTGkJOUyAoLmJjaCBvbiBC
+aXRjb2luIENhc2gpMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4igg
+3dQZUNedViiuXNjlwtNBpsNnjTQYCmvFqwBuUH7r5VT1zPzdANMyDwE93NrYWEmO
+LQY+SqnlKKOAiaZOKVegCdJ2xUwn8D62GVR3MT7/31+VAZHvh4GqRQkHzDR7/0Ch
+EhGom+aZE/N/y30FpTQytUI/0FQJnHdRtIRkRR1fKg8uUI23PhHNMuT6EYjYhObb
+LMIUzXnP3f48OmI2A8die/n2sfXwrNBqrtc/OzO2XuQm0uBP38R8CBnuy+W/NeSw
+BRB2BgmdawZc3e4MxnqpsTR76QcCy6XLtJVBNRtFwK7/Jb00DV7zX4xRw8BQ1N24
+yHXfSh15FvUXJMCplwIDAQABo4GuMIGrMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0P
+AQH/BAQDAgEGMB0GA1UdDgQWBBTD3l5ztWFyW1di/HaXt2FUNFz1tzBpBgNVHR4B
+Af8EXzBdoCkwBYIDYmNoMAWCA3AycDAFggNiaXQwBYIDbmF2MAaCBHRlc3QwA4IB
+eKEwMAqHCAAAAAAAAAAAMCKHIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+AAAAMA0GCSqGSIb3DQEBCwUAA4IBAQAL5JTGXJ39nR9q8U8YH4Oaq13XINbZycRv
+2yG+PQaNlPCwSOucMvatN1+DQqW5dSTulu2e873KrXraBYjXphFUSfTS8nMEi92U
+B5+f0l+MSAJXDKc8RwNJ/7SDYblodUg3bN6x70RHFMlAq6FcIondpTEBbOPdaDDi
+pw+mLnQj+55xMXV0yxkgsvc/SxdXyLLm7uTWRzKJQi0N3p4YYOEURIyZ491gprwF
+QTt0WeBYmRc1MLXbs9D0Svh6D4d0ovKZawZ83rx+TfM7nSfxV6VubbOV/urXtgyh
+84Bcq9+1cZZMNAT86uBW+EF7J70mJlctSmwHdIXdxXDaVtl+rZ4o
+-----END CERTIFICATE-----