diff --git a/.gitea/workflows/deploy-health.yml b/.gitea/workflows/deploy-health.yml
index 6385dfd..5f7cc21 100644
--- a/.gitea/workflows/deploy-health.yml
+++ b/.gitea/workflows/deploy-health.yml
@@ -36,7 +36,12 @@ jobs:
           problems=""
           for row in $(python3 -c 'import json; d=json.load(open("tools/gitea-pipeline/repos.json")); [print(k+"="+v["target_path"]) for k,v in d.items() if not k.startswith("_") and v.get("target_path")]'); do
             repo=${row%%=*}; tp=${row#*=}; slug=$(printf '%s' "$tp" | tr '/' '_')
-            head=$(curl -s -H "$H" "$API/repos/peptide-repo/$repo/branches/main" | python3 -c 'import json,sys;print(json.load(sys.stdin)["commit"]["id"])')
+            # The job token is scoped to peptide-e2e; the repos are public, so read
+            # their branches anonymously. Unreadable main = a problem, not a crash.
+            head=$(curl -s "$API/repos/peptide-repo/$repo/branches/main" | python3 -c 'import json,sys
+          try: print(json.load(sys.stdin)["commit"]["id"])
+          except Exception: print("")')
+            if [ -z "$head" ]; then problems="$problems\n- $repo: could not read main from Gitea"; continue; fi
             stamp=$(ssh $SSHOPT "$SSH_USERNAME@$SSH_HOST" "cat ~/.peptide-deploys/production/$slug 2>/dev/null" || true)
             dep=${stamp%% *}
             if [ -z "$dep" ]; then