diff --git a/.forgejo/workflows/build-images.yml b/.forgejo/workflows/build-images.yml
index 7635979..38fa582 100644
--- a/.forgejo/workflows/build-images.yml
+++ b/.forgejo/workflows/build-images.yml
@@ -82,10 +82,18 @@ jobs:
 
       - name: Login to Harbor (push jobs only)
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        # Harbor robot usernames contain `$` (e.g. `robot$basicstack+ci`),
+        # so inlining `${{ secrets.HARBOR_USERNAME }}` directly in the
+        # `run:` script makes bash expand `$basicstack` (and die under
+        # `set -u`). Pass the secrets as env vars so the shell only sees
+        # them as plain strings.
+        env:
+          HARBOR_USERNAME: ${{ secrets.HARBOR_USERNAME }}
+          HARBOR_PASSWORD: ${{ secrets.HARBOR_PASSWORD }}
         run: |
           set -eu
-          echo "${{ secrets.HARBOR_PASSWORD }}" | \
-            docker login "${REGISTRY}" --username "${{ secrets.HARBOR_USERNAME }}" --password-stdin
+          echo "${HARBOR_PASSWORD}" | \
+            docker login "${REGISTRY}" --username "${HARBOR_USERNAME}" --password-stdin
 
       - name: Push image (main only)
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'