diff --git a/README.md b/README.md
index e43c9fb..168e9c9 100644
--- a/README.md
+++ b/README.md
@@ -143,6 +143,9 @@ boot; if Podman says the device is unknown, run
   this width.
 - **PIA VPN:** the official Linux app works on Ubuntu (it couldn't on Bazzite's read-only
   `/usr`). Download the installer from PIA and run it.
+- **Gitea:** your first `git push` asks for your username and password (or token) once —
+  KDE Wallet was answering that for you here, and the GNOME keyring takes over on Ubuntu.
+  Keyrings aren't in the backup, so no other password comes across either.
 
 ## Coming from Bazzite: what moved
 
diff --git a/scripts/setup.sh b/scripts/setup.sh
index dfd83e8..f3dcb2b 100755
--- a/scripts/setup.sh
+++ b/scripts/setup.sh
@@ -185,6 +185,35 @@ sudo systemctl daemon-reload
 sudo systemctl enable flatpak-update.timer
 
 # ---------------------------------------------------------------------------------------
+step "Git credentials in the keyring"
+# On Bazzite, KDE Wallet fed git your Gitea password through ksshaskpass. GNOME's keyring does
+# the same job via git's libsecret helper, which Ubuntu ships as source only — so build it.
+if ! git config --global --get credential.helper >/dev/null 2>&1; then
+  helper="" src=/usr/share/doc/git/contrib/credential/libsecret
+  if [[ -e $src/git-credential-libsecret.c || -e $src/git-credential-libsecret.c.gz ]]; then
+    apt_install libsecret-1-dev libglib2.0-dev
+    tmp=$(mktemp -d)
+    if [[ -e $src/git-credential-libsecret.c.gz ]]; then
+      zcat "$src/git-credential-libsecret.c.gz" > "$tmp/h.c"
+    else
+      cp "$src/git-credential-libsecret.c" "$tmp/h.c"
+    fi
+    read -ra cf < <(pkg-config --cflags libsecret-1 glib-2.0)
+    read -ra lf < <(pkg-config --libs libsecret-1 glib-2.0)
+    if cc -O2 "${cf[@]}" "$tmp/h.c" -o "$tmp/git-credential-libsecret" "${lf[@]}" 2>/dev/null; then
+      sudo install -m 755 "$tmp/git-credential-libsecret" /usr/local/bin/
+      helper=/usr/local/bin/git-credential-libsecret
+    fi
+    rm -rf "$tmp"
+  fi
+  if [[ -n $helper ]]; then
+    git config --global credential.helper "$helper"
+  else
+    git config --global credential.helper 'cache --timeout=604800'
+    warn "no keyring helper — git will hold your Gitea password for a week at a time instead"
+  fi
+fi
+
 step "Claude Code CLI"
 # No Node or .NET on the host by choice — LudosData and landingPage build in Docker.
 # If you want them back: sudo apt install mise dotnet-sdk-10.0 (mise needs ppa:jdxcode/mise).