diff --git a/PUBLIC_SOURCE_EXPORT.md b/PUBLIC_SOURCE_EXPORT.md
index 0aba2e1..4eec050 100644
--- a/PUBLIC_SOURCE_EXPORT.md
+++ b/PUBLIC_SOURCE_EXPORT.md
@@ -1,3 +1,3 @@
 # Public source export
 
-This source snapshot was generated from the private canonical repository at revision `7fde2770ba344c684b7e7a6b74f763dc19e7c560`. It contains no private Git history or operational evidence. Changes are published from the canonical repository.
+This source snapshot was generated from the private canonical repository at revision `0e2f0e88b0359a4ed82515b4b04c0f80069e5e0a`. It contains no private Git history or operational evidence. Changes are published from the canonical repository.
diff --git a/PUBLIC_SOURCE_MANIFEST.json b/PUBLIC_SOURCE_MANIFEST.json
index e6a3758..b48ad52 100644
--- a/PUBLIC_SOURCE_MANIFEST.json
+++ b/PUBLIC_SOURCE_MANIFEST.json
@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "sourceRevision": "7fde2770ba344c684b7e7a6b74f763dc19e7c560",
+  "sourceRevision": "0e2f0e88b0359a4ed82515b4b04c0f80069e5e0a",
   "files": [
     {
       "path": ".dockerignore",
@@ -3359,8 +3359,8 @@
     },
     {
       "path": "tests/test_mcp_hub_release_images.py",
-      "sha256": "8507bffd7ea3b34a00ec6f52849f9106fae37f1623de0804bda0b475e776b803",
-      "bytes": 21009
+      "sha256": "fcf3a377e47f3e6a4b4410cfcb8f91e5bd9eee090de3ed52e2b581e5ed6417b7",
+      "bytes": 21914
     },
     {
       "path": "tests/test_mcp_workflow_prompts.py",
diff --git a/tests/test_mcp_hub_release_images.py b/tests/test_mcp_hub_release_images.py
index e9d7f14..b20e1cc 100644
--- a/tests/test_mcp_hub_release_images.py
+++ b/tests/test_mcp_hub_release_images.py
@@ -18,6 +18,30 @@ ROOT = Path(__file__).resolve().parents[1]
 SCRIPT = ROOT / "scripts" / "build_mcp_hub_release_images.py"
 
 
+def test_protected_metadata_uses_fixed_https_without_redirecting_credentials(monkeypatch):
+    class Opener:
+        def open(self, request, timeout):
+            assert request.full_url == (
+                "https://gitea.example.com/api/v1/repos/jens/itworx_mcp_hub/actions/runs/123"
+            )
+            assert request.get_header("Authorization") == "token fixture-token"
+            assert timeout == 20
+            return io.BytesIO(b'{"id":123}')
+
+    def build_opener(*handlers):
+        assert handlers[0].proxies == {}
+        assert (
+            handlers[1].redirect_request(None, None, 302, "redirect", {}, "https://other.test")
+            is None
+        )
+        return Opener()
+
+    monkeypatch.setattr(producer.urllib.request, "build_opener", build_opener)
+    assert producer._api_json("fixture-token", "/repos/jens/itworx_mcp_hub/actions/runs/123") == {
+        "id": 123
+    }
+
+
 def _write_archive_fixture(path: Path, members: dict[str, bytes | None]) -> None:
     with tarfile.open(path, "w:", format=tarfile.USTAR_FORMAT) as archive:
         for name, payload in members.items():