diff --git a/.gitea/workflows/build-deploy.yml b/.gitea/workflows/build-deploy.yml
index 2e7e74d..4b11316 100644
--- a/.gitea/workflows/build-deploy.yml
+++ b/.gitea/workflows/build-deploy.yml
@@ -19,6 +19,10 @@ jobs:
         uses: actions/checkout@v4
         with:
           submodules: recursive
+          # Default job token only covers this repo; the theme submodule
+          # (hmk/pelican-latex) is a separate private repo, so a token with
+          # read access to both is needed here.
+          token: ${{ secrets.CHECKOUT_TOKEN }}
 
       - name: Install Python dependencies
         run: pip install --no-cache-dir -r requirements.txt