diff --git a/.gitea/workflows/app_builder.yaml b/.gitea/workflows/app_builder.yaml
index 2d9a3b8..edbe016 100644
--- a/.gitea/workflows/app_builder.yaml
+++ b/.gitea/workflows/app_builder.yaml
@@ -129,7 +129,6 @@ jobs:
     environment: production
     env:
       AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
-      ARTIFACT_BASE_URL: ${{ vars.ARTIFACT_BASE_URL }}
       GITEA_API: https://git.cbsk-tech.de/api/v1
       OWNER: Christoph
       REPO: GitLite
@@ -249,16 +248,24 @@ jobs:
         run: |
           set -euo pipefail
 
-          LATEST_JSON="$(curl --fail --location --silent --show-error \
-            "$ARTIFACT_BASE_URL/gitty/latest.json")"
-          export LATEST_JSON
-          APPIMAGE_URL="$(node -e "const p=JSON.parse(process.env.LATEST_JSON); const a=p.platforms?.['linux-x86_64']?.url; if (!a) process.exit(1); process.stdout.write(a)")"
-          APPIMAGE_NAME="${APPIMAGE_URL##*/}"
+          TOKEN="${GITEA_TOKEN:-${GITEA_FALLBACK_TOKEN:-}}"
+          if [ -z "$TOKEN" ]; then
+            echo "A Gitea token is required to download the AppImage" >&2
+            exit 1
+          fi
+
+          RELEASE_JSON="$(curl --fail --location --silent --show-error \
+            --header "Authorization: token $TOKEN" \
+            "$GITEA_API/repos/$OWNER/$REPO/releases/tags/$RELEASE_TAG")"
+          export RELEASE_JSON
+          APPIMAGE_URL="$(node -e "const r=JSON.parse(process.env.RELEASE_JSON); const a=(r.assets || []).find(a => String(a.name || '').toLowerCase().endsWith('.appimage')); if (!a?.browser_download_url) process.exit(1); process.stdout.write(a.browser_download_url)")"
+          APPIMAGE_NAME="$(node -e "const r=JSON.parse(process.env.RELEASE_JSON); const a=(r.assets || []).find(a => String(a.name || '').toLowerCase().endsWith('.appimage')); if (!a?.name) process.exit(1); process.stdout.write(a.name)")"
 
           AUR_BIN_DIR="$(mktemp -d)"
           cp PKGBUILD-bin "$AUR_BIN_DIR/PKGBUILD"
           APPIMAGE_PATH="$AUR_BIN_DIR/$APPIMAGE_NAME"
           curl --fail --location --silent --show-error \
+            --header "Authorization: token $TOKEN" \
             --output "$APPIMAGE_PATH" "$APPIMAGE_URL"
           APPIMAGE_CHECKSUM="$(sha256sum "$APPIMAGE_PATH" | cut -d ' ' -f 1)"
           ICON_PATH="$AUR_BIN_DIR/gitty-desktop.png"