diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 1ceea64..b8aad9f 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -249,8 +249,10 @@ jobs:
     - name: Render nginx.conf and write to host
       run: |
         set -euo pipefail
-        apk add --no-cache gettext >/dev/null
-        envsubst < nginx/nginx.conf > /tmp/nginx.conf
+        apk add --no-cache gettext >/dev/null  # envsubst
+        # Only substitute the vars we intend to: ${PROD_*_PORT}
+        envsubst '${PROD_FRONTEND_PORT} ${PROD_BACKEND_PORT}' < nginx/nginx.conf > /tmp/nginx.conf
+
         podman --remote run --rm -i \
           --userns=keep-id \
           -v /opt/sharenet/nginx:/host-nginx:rw \