diff --git a/npins/sources.json b/npins/sources.json
index 221c3ae..a65b7a8 100644
--- a/npins/sources.json
+++ b/npins/sources.json
@@ -3,8 +3,8 @@
     "nixpkgs": {
       "type": "Channel",
       "name": "nixpkgs-unstable",
-      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre946843.ac055f38c798/nixexprs.tar.xz",
-      "hash": "sha256-erxy9meNKMaKpKQpl8KfhZsVY4EtR4eaHT94jY98Ty0="
+      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1016568.9eac87a12312/nixexprs.tar.xz",
+      "hash": "sha256-eV3ovGgoOtmw+5PIl3LqZ2/NX2UGPqs2MlfzbGcU+bA="
     }
   },
   "version": 7
diff --git a/sr/action.yaml b/sr/action.yaml
index 0f42bb4..af4054f 100644
--- a/sr/action.yaml
+++ b/sr/action.yaml
@@ -9,7 +9,10 @@ inputs:
     default: https://git.oceanbox.io
 
   gitea-token:
-    description: Gitea access token
+    description: >-
+      Gitea access token used to push the release commit and create the
+      release. On branch-protected branches this must be a PAT of a real user
+      on the branch's push whitelist, not the Actions token (uid -2).
     required: true
 
   nix-shell:
@@ -110,6 +113,20 @@ runs:
         }
         EOF
 
+    - name: Pin origin remote to the provided token
+      shell: bash
+      env:
+        GITEA_TOKEN: ${{ inputs.gitea-token }}
+        GITEA_URL: ${{ inputs.gitea-url }}
+      run: |
+        set -o pipefail
+        set -o nounset
+        set -o errexit
+        # Push as the real user behind GITEA_TOKEN, not the checkout's Actions token (uid -2).
+        repo_path="$(git remote get-url origin | sed -E 's#^https?://[^/]+/##')"
+        host="$(echo "$GITEA_URL" | sed -E 's#^https?://##; s#/$##')"
+        git remote set-url origin "https://oauth2:${GITEA_TOKEN}@${host}/${repo_path}"
+
     - name: Run semantic-release
       id: semantic
       shell: bash