diff --git a/README.md b/README.md
index 6a2a820..e396248 100644
--- a/README.md
+++ b/README.md
@@ -52,6 +52,10 @@ environment variables / command-line arguments):
 |---|---|
 | `webgit.worktree-path` | Path to the shared network drive where working trees are stored (the files your retro machines will access). |
 | `webgit.git-dir-path` | Path where `.git` directories are stored (can be a local disk on the server). |
+| `webgit.username` | Username for push/pull authentication (e.g. a dedicated Gitea account). |
+| `webgit.password` | Password or access token for push/pull authentication. |
+
+Credentials can be supplied via environment variables (`WEBGIT_USERNAME`, `WEBGIT_PASSWORD`) to avoid storing them in config files.
 
 Example:
 
diff --git a/src/main/java/be/seeseepuff/webgit/service/GitService.java b/src/main/java/be/seeseepuff/webgit/service/GitService.java
index d76a32a..fc34981 100644
--- a/src/main/java/be/seeseepuff/webgit/service/GitService.java
+++ b/src/main/java/be/seeseepuff/webgit/service/GitService.java
@@ -615,7 +615,11 @@ public class GitService
 	{
 		try (Git git = openRepository(name))
 		{
-			git.push().call();
+			var cmd = git.push();
+			if (properties.getUsername() != null)
+				cmd.setCredentialsProvider(new org.eclipse.jgit.transport.UsernamePasswordCredentialsProvider(
+					properties.getUsername(), properties.getPassword()));
+			cmd.call();
 		}
 	}
 
@@ -623,7 +627,11 @@ public class GitService
 	{
 		try (Git git = openRepository(name))
 		{
-			git.pull().call();
+			var cmd = git.pull();
+			if (properties.getUsername() != null)
+				cmd.setCredentialsProvider(new org.eclipse.jgit.transport.UsernamePasswordCredentialsProvider(
+					properties.getUsername(), properties.getPassword()));
+			cmd.call();
 		}
 	}
 
diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
index 876deb0..323f93e 100644
--- a/src/main/resources/application.properties
+++ b/src/main/resources/application.properties
@@ -4,3 +4,7 @@ webgit.worktree-path=./webgit/worktree
 
 webgit.telnet.enabled=true
 webgit.telnet-port=2323
+
+# Optional: credentials for push/pull (can also be set via WEBGIT_USERNAME / WEBGIT_PASSWORD env vars)
+#webgit.username=
+#webgit.password=