diff --git a/.gitea/workflows/security.yml b/.gitea/workflows/security.yml
index 0f6f4a0..e270c74 100644
--- a/.gitea/workflows/security.yml
+++ b/.gitea/workflows/security.yml
@@ -24,8 +24,10 @@ jobs:
       - name: Tooling
         run: apk add --no-cache git curl bash tar python3
 
-      - name: Repo auschecken (git.eulernest.eu -> LAN via Runner-add-host)
-        run: git clone --depth 1 "https://git.eulernest.eu/${GITHUB_REPOSITORY}.git" src
+      - name: Repo auschecken (Auto-Token — Org-Repo braucht Auth; LAN via add-host)
+        env:
+          GITEA_TOKEN: ${{ github.token }}
+        run: git clone --depth 1 "https://x-access-token:${GITEA_TOKEN}@git.eulernest.eu/${GITHUB_REPOSITORY}.git" src
 
       - name: Gitleaks (Secret-Scan, ARM64)
         id: gl
@@ -40,7 +42,7 @@ jobs:
         run: |
           curl -sSL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh \
             | sh -s -- -b /usr/local/bin
-          cd src && trivy config --severity HIGH,CRITICAL --exit-code 1 --no-progress . 2>&1 | tee -a /tmp/scan.log
+          cd src && trivy config --severity HIGH,CRITICAL --exit-code 1 . 2>&1 | tee -a /tmp/scan.log
           echo "code=${PIPESTATUS[0]}" >> "$GITHUB_OUTPUT"
 
       - name: Gate — hart blockieren bei Funden