diff --git a/k8s/apps/forgejo/deployment.yaml b/k8s/apps/forgejo/deployment.yaml
index 3e2c775..6a582ce 100644
--- a/k8s/apps/forgejo/deployment.yaml
+++ b/k8s/apps/forgejo/deployment.yaml
@@ -65,8 +65,12 @@ spec:
                 secretKeyRef:
                   name: forgejo-secret
                   key: secret-key
+            # Miroir : ne tire que depuis GitHub. La migration appelle plusieurs hôtes :
+            # api.github.com (issues/releases), codeload.github.com (archives) et
+            # objects.githubusercontent.com (assets de release) — sinon
+            # « migration can only call allowed HTTP servers ... deny <hôte> ».
             - name: FORGEJO__migrations__ALLOWED_DOMAINS
-              value: "github.com"   # miroir : ne tire que depuis GitHub
+              value: "github.com,*.github.com,*.githubusercontent.com"
             - name: USER_UID
               value: "1000"
             - name: USER_GID