diff --git a/gitea/application.yaml b/gitea/application.yaml
index bec2cd1..2729a3e 100644
--- a/gitea/application.yaml
+++ b/gitea/application.yaml
@@ -139,6 +139,13 @@ spec:
               value: "/cert/tls.key"
             - name: GITEA__SERVER__SSH_PORT
               value: "22"
+            # Port advertised in clone URLs is 22, but the rootless container
+            # cannot bind it, so the builtin server listens on 2222 and the
+            # Service maps 22 -> 2222. Until 1.26 the image defaulted
+            # SSH_LISTEN_PORT to SSH_PORT; it is empty now, which makes Gitea
+            # fall back to SSH_PORT and crash with "bind: permission denied".
+            - name: GITEA__SERVER__SSH_LISTEN_PORT
+              value: "2222"
             - name: GITEA__SERVER__PROTOCOL
               value: https
             - name: GITEA__SERVER__REDIRECT_OTHER_PORT