diff --git a/nix/modules/hive-forge.nix b/nix/modules/hive-forge.nix
index 743834f9..b5ded526 100644
--- a/nix/modules/hive-forge.nix
+++ b/nix/modules/hive-forge.nix
@@ -60,6 +60,21 @@ in
       '';
     };
 
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.forgejo;
+      defaultText = lib.literalExpression "pkgs.forgejo";
+      description = ''
+        Forgejo package to run inside the container. Defaults to
+        `pkgs.forgejo` (the latest release line) rather than the
+        nixpkgs-module default of `pkgs.forgejo-lts`, because LTS
+        lags far behind on schema and the DB easily ends up "newer
+        than the binary" if the operator ever ran a non-LTS forgejo
+        against the same state dir. Override to `pkgs.forgejo-lts`
+        if you actively want the slower release train.
+      '';
+    };
+
     openFirewall = lib.mkOption {
       type = lib.types.bool;
       default = true;
@@ -87,6 +102,7 @@ in
           system.stateVersion = "25.11";
           services.forgejo = {
             enable = true;
+            package = cfg.package;
             database.type = "sqlite3";
             lfs.enable = true;
             settings = {
diff --git a/scripts/forge-create-token.sh b/scripts/forge-create-token.sh
new file mode 100755
index 00000000..4e46a8db
--- /dev/null
+++ b/scripts/forge-create-token.sh
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Mint a Forgejo access token for an existing user.
+#
+# Usage: forge-create-token.sh <username> [--name <label>] [--scopes <csv>]
+#
+# Defaults:
+#   --name   = local-<timestamp>
+#   --scopes = all
+#
+# Prints the token to stdout — feed it to `forge-login.sh` or paste
+# into tea / .netrc. Forgejo only shows the token once, so capture it.
+set -euo pipefail
+
+if [ $# -lt 1 ]; then
+  echo "usage: $0 <username> [--name <label>] [--scopes <csv>]" >&2
+  exit 2
+fi
+
+username="$1"; shift
+name="local-$(date +%s)"
+scopes="all"
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --name)   name="$2"; shift 2 ;;
+    --scopes) scopes="$2"; shift 2 ;;
+    *) echo "unknown arg: $1" >&2; exit 2 ;;
+  esac
+done
+
+sudo nixos-container run hive-forge -- runuser -u forgejo -- \
+  forgejo --work-path /var/lib/forgejo admin user generate-access-token \
+    --username "$username" \
+    --token-name "$name" \
+    --scopes "$scopes"
diff --git a/scripts/forge-login.sh b/scripts/forge-login.sh
new file mode 100755
index 00000000..9c603036
--- /dev/null
+++ b/scripts/forge-login.sh
@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+# Configure the current shell user's git + tea for the hive-forge.
+#
+# Sets:
+#   - git config --global user.name / user.email
+#   - tea login (if `tea` is on PATH)
+#   - ~/.netrc entry so `git clone http://...` works without prompting
+#
+# Usage: forge-login.sh <username> [--email <addr>] [--url <forge-url>]
+#
+# Prompts for an access token on stdin (paste-and-enter). Generate
+# one first with `forge-create-token.sh <username>` or in the web UI
+# under Settings → Applications → Generate New Token.
+set -euo pipefail
+
+if [ $# -lt 1 ]; then
+  echo "usage: $0 <username> [--email <addr>] [--url <forge-url>]" >&2
+  exit 2
+fi
+
+username="$1"; shift
+email="${username}@hive.local"
+forge_url="http://localhost:3000"
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --email) email="$2"; shift 2 ;;
+    --url)   forge_url="$2"; shift 2 ;;
+    *) echo "unknown arg: $1" >&2; exit 2 ;;
+  esac
+done
+
+# Extract host:port for netrc.
+host=$(printf '%s' "$forge_url" | sed -E 's|^https?://||; s|/.*$||; s|:.*$||')
+
+read -r -s -p "forgejo access token for $username (input hidden): " token
+echo
+if [ -z "$token" ]; then
+  echo "no token entered; aborting" >&2
+  exit 1
+fi
+
+if git config --global user.name "$username" 2>/dev/null \
+  && git config --global user.email "$email" 2>/dev/null; then
+  echo "git config: $username <$email>"
+else
+  cat <<EOF
+git config: --global write failed (read-only ~/.config/git/config?
+  home-manager / nix-managed setup). add this to your home-manager:
+
+  programs.git = {
+    enable = true;
+    userName = "$username";
+    userEmail = "$email";
+  };
+EOF
+fi
+
+# netrc entry — git uses this for HTTP basic auth. 0600 because it
+# contains the plaintext token.
+netrc="$HOME/.netrc"
+touch "$netrc"
+chmod 600 "$netrc"
+if grep -q "^machine $host" "$netrc" 2>/dev/null; then
+  # Remove the old block (machine line + the two following lines).
+  sed -i.bak "/^machine $host\$/,+2d" "$netrc"
+fi
+cat >>"$netrc" <<EOF
+machine $host
+login $username
+password $token
+EOF
+echo "netrc: wrote $host entry"
+
+if command -v tea >/dev/null 2>&1; then
+  mkdir -p "$HOME/.config/tea"
+  # tea refuses to add a login with a name that already exists; drop
+  # it first so re-running this script is idempotent.
+  tea login delete forge 2>/dev/null || true
+  tea login add --name forge --url "$forge_url" --token "$token"
+  echo "tea: configured 'forge' login"
+else
+  echo "tea: not on PATH — install pkgs.tea if you want the CLI"
+fi
diff --git a/scripts/forge-migrate.sh b/scripts/forge-migrate.sh
new file mode 100755
index 00000000..bbdc5baf
--- /dev/null
+++ b/scripts/forge-migrate.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# Run pending Forgejo DB migrations + restart the daemon.
+#
+# Use after upgrading the forgejo package, or when a CLI command
+# errors with "table X has no column named Y" (schema lag).
+set -euo pipefail
+
+sudo nixos-container run hive-forge -- runuser -u forgejo -- \
+  forgejo --work-path /var/lib/forgejo migrate
+
+sudo nixos-container run hive-forge -- systemctl restart forgejo
+echo "forge: migrated + restarted"