diff --git a/.github/workflows/kube-bench-scan.yml b/.github/workflows/kube-bench-scan.yml
index f8b2a5f..ddee1c8 100644
--- a/.github/workflows/kube-bench-scan.yml
+++ b/.github/workflows/kube-bench-scan.yml
@@ -119,7 +119,9 @@ jobs:
 
       - name: Upload kube-bench report
         if: always()
-        uses: actions/upload-artifact@v4
+        # Upstream v4 rejects Gitea because it identifies as GHES.
+        # This compatible fork retains the v4 interface on both forges.
+        uses: christopherHX/gitea-upload-artifact@v4
         with:
           name: kube-bench-k3s-cis-1.7
           path: artifacts/kube-bench-k3s-cis-1.7.json
diff --git a/ci/README.md b/ci/README.md
index 8a58b11..175601e 100644
--- a/ci/README.md
+++ b/ci/README.md
@@ -48,6 +48,11 @@ access because the workflow creates a k3d cluster and runs the kube-bench Job.
 Register a dedicated runner for this repository rather than sharing a runner
 with unrelated repositories.
 
+The report upload uses the Gitea-compatible `gitea-upload-artifact` v4 fork.
+The upstream `actions/upload-artifact` v4 action identifies Gitea as GitHub
+Enterprise Server and exits before uploading. The compatible fork retains the
+same workflow interface for GitHub Actions and Gitea Actions.
+
 Example Docker runner setup, with the registration token supplied separately:
 
 ```bash