diff --git a/.github/workflows/fetch-upstream-mods.yml b/.github/workflows/fetch-upstream-mods.yml
index 58872056..728face6 100644
--- a/.github/workflows/fetch-upstream-mods.yml
+++ b/.github/workflows/fetch-upstream-mods.yml
@@ -42,22 +42,17 @@ jobs:
           git config user.name "jim[bot]"
           git config user.email "jim[bot]@users.noreply.github.com"
 
-          # Provide HTTP auth for both git and git-lfs
-          cat > ~/.netrc <<EOF
-machine smallgit.dasguney.com
-login skyline
-password ${GITEA_TOKEN}
-EOF
+          # Write .netrc safely (no heredoc)
+          printf "machine smallgit.dasguney.com\nlogin skyline\npassword %s\n" "$GITEA_TOKEN" > ~/.netrc
           chmod 600 ~/.netrc
 
-          # Use direct Gitea HTTP endpoint (no nginx)
+          # Use direct Gitea HTTP endpoint
           git remote set-url origin http://smallgit.dasguney.com:3000/skyline/balatro-mod-index.git
 
-          # Force git-lfs to use the same endpoint and disable locking checks
+          # Make git-lfs use the same endpoint and disable lock verification
           git config lfs.url "http://smallgit.dasguney.com:3000/skyline/balatro-mod-index.git/info/lfs"
           git config lfs."http://smallgit.dasguney.com:3000/skyline/balatro-mod-index.git/info/lfs".locksverify false
 
-          # Ensure LFS hooks are consistent (or skip if not needed)
           git lfs install --local || true
 
           git add mods