diff --git a/.gitea/workflows/build-image.yml b/.gitea/workflows/build-image.yml
index d88e8e5..7d7d9fa 100644
--- a/.gitea/workflows/build-image.yml
+++ b/.gitea/workflows/build-image.yml
@@ -108,7 +108,10 @@ jobs:
           # write ~/.netrc or ~/.config/go/env. Guarded on a non-empty secret:
           # `grep -F ""` matches every file, so a secretless run (fork PR) would
           # fail here with a message accusing it of leaking nothing.
-          if [ -n "${REGISTRY_PASSWORD:-}" ] && grep -rqF "$REGISTRY_PASSWORD" "$HOME" 2>/dev/null; then
+          # -e, so a password beginning with "-" is a pattern and not options:
+          # without it the check errors out and, under `set -e`, fails the step
+          # with a message about grep usage rather than about credentials.
+          if [ -n "${REGISTRY_PASSWORD:-}" ] && grep -rqF -e "$REGISTRY_PASSWORD" "$HOME" 2>/dev/null; then
             echo "::error::registry credential still present under \$HOME after scrub"
             exit 1
           fi