diff --git a/deploy/nexus/genome-askpass.sh b/deploy/nexus/genome-askpass.sh
new file mode 100644
index 0000000..104b3b7
--- /dev/null
+++ b/deploy/nexus/genome-askpass.sh
@@ -0,0 +1,19 @@
+#!/bin/bash
+#
+# GIT_ASKPASS helper for Forgejo HTTP authentication.
+# Git invokes this script when it needs a username or password.
+#
+
+set -eu
+
+# Load environment variables
+. "${HOME}/.config/knowledge-genome.env"
+
+case "${1:-}" in
+  *[Uu]sername*)
+    printf '%s\n' "${FORGEJO_USER:-n8n-bot}"
+    ;;
+  *)
+    printf '%s\n' "${FORGEJO_TOKEN:?FORGEJO_TOKEN not set}"
+    ;;
+esac