diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index f61345a6..abe83a04 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -115,6 +115,13 @@ jobs:
           python3 -m venv .venv
           .venv/bin/pip install --upgrade pip
           .venv/bin/pip install -r requirements.txt
+      - name: Drop the git-crypt .env
+        # .env is committed git-crypt encrypted. CI has no key, so the checked
+        # out file is the raw encrypted blob and python-dotenv dies reading it
+        # as UTF-8. This job supplies DATABASE_URL, SECRET_KEY and
+        # JWT_SECRET_KEY through env: already, so the file is not needed.
+        run: rm -f .env
+
       - name: Force utf8mb4 on the CI database
         # Uses pymysql, already a runtime dependency, rather than the mysql CLI,
         # which is not present in every runner image.