diff --git a/.gitea/workflows/ci-deploy.yml b/.gitea/workflows/ci-deploy.yml
index e5be904..aa8827b 100644
--- a/.gitea/workflows/ci-deploy.yml
+++ b/.gitea/workflows/ci-deploy.yml
@@ -21,7 +21,9 @@ jobs:
           cd repo
 
           if [ -n "${CLONE_TOKEN:-}" ]; then
-            AUTH_URL="$(printf '%s' "${CLONE_URL}" | sed -E "s#^https?://#https://${CLONE_TOKEN}@#")"
+            # Some tokens may contain characters like '#', which would break sed if unescaped.
+            SAFE_TOKEN="$(printf '%s' "${CLONE_TOKEN}" | sed -e 's/[&|\\]/\\&/g')"
+            AUTH_URL="$(printf '%s' "${CLONE_URL}" | sed -E "s|^https?://|https://${SAFE_TOKEN}@|")"
             git clone --no-tags --depth 1 "${AUTH_URL}" .
           else
             git clone --no-tags --depth 1 "${CLONE_URL}" .