diff --git a/.forgejo/workflows/integration.yml b/.forgejo/workflows/integration.yml
index 13465c0..3c7f9bf 100644
--- a/.forgejo/workflows/integration.yml
+++ b/.forgejo/workflows/integration.yml
@@ -3,20 +3,18 @@ on:
   push:
     branches:
       - "**"
-    branches-ignore:
-      - renovate/** # they are build via PR
 
 env:
-  FORGEJO_VERSION: 11.0.16 # renovate: datasource=docker depName=data.forgejo.org/forgejo/forgejo
+  FORGEJO_VERSION: 11.0.10 # renovate: datasource=docker depName=data.forgejo.org/forgejo/forgejo
 
 jobs:
   integration:
     runs-on: lxc-trixie
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@v6
 
       - id: forgejo
-        uses: https://code.forgejo.org/actions/setup-forgejo@0191c04814b526caf141138a5567000ab08ddae0 # v3.2.0
+        uses: https://code.forgejo.org/actions/setup-forgejo@v3.1.4
         with:
           user: testuser
           password: admin1234
diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
index 672c1a2..e3c5bca 100644
--- a/.forgejo/workflows/release.yml
+++ b/.forgejo/workflows/release.yml
@@ -9,7 +9,7 @@ jobs:
 
     steps:
       # needs to be in a different dir, so binary and rna cache don't conflict
-      - uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: https://data.forgejo.org/actions/checkout@v6
         with:
           path: forgejo-release
 
@@ -21,8 +21,3 @@ jobs:
           verbose: ${{ vars.VERBOSE || 'false' }}
           release-notes-assistant: true
           skip-assets: true
-
-      # extract short version from tag and push as branch
-      - run: git push -f origin $FORGEJO_REF_NAME:${FORGEJO_REF_NAME%%.*}
-        shell: bash
-        working-directory: ./forgejo-release
diff --git a/.forgejo/workflows/tests.yml b/.forgejo/workflows/tests.yml
index 05a1395..d521c77 100644
--- a/.forgejo/workflows/tests.yml
+++ b/.forgejo/workflows/tests.yml
@@ -2,9 +2,7 @@ on:
   pull_request:
   push:
     branches:
-      - '**'
-    branches-ignore:
-      - renovate/** # they are build via PR
+      - "**"
 
 jobs:
   tests:
@@ -13,7 +11,7 @@ jobs:
       image: data.forgejo.org/oci/node:24-trixie
 
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@v6
 
       - name: lint action-docs
         run: |
@@ -26,4 +24,6 @@ jobs:
 
       - name: Unit tests of the supporting script forgejo-release.sh
         run: |
+          testdata/forgejo-release-test.sh test_system_tea_bin
+          testdata/forgejo-release-test.sh test_download_tea_bin
           testdata/forgejo-release-test.sh test_maybe_sign_release
diff --git a/README.md b/README.md
index a0fac14..53bf39a 100644
--- a/README.md
+++ b/README.md
@@ -44,7 +44,7 @@ jobs:
     runs-on: docker
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/forgejo-release@v2.13.4
+      - uses: actions/forgejo-release@v2.9.1
         with:
           direction: upload
           url: https://my-forgejo-instance.net
@@ -65,7 +65,7 @@ jobs:
       - uses: actions/checkout@v4
       - name: Generate Changelog
         run: ./generate-changelog.sh > dist/changelog.md
-      - uses: actions/forgejo-release@v2.13.4
+      - uses: actions/forgejo-release@v2.7.3
         with:
           direction: upload
           url: https://my-forgejo-instance.net
@@ -86,7 +86,7 @@ jobs:
     runs-on: docker
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/forgejo-release@v2.13.4
+      - uses: actions/forgejo-release@v2.9.1
         with:
           direction: download
           url: https://my-forgejo-instance.net
diff --git a/action.yml b/action.yml
index 40338c0..22fd511 100644
--- a/action.yml
+++ b/action.yml
@@ -63,7 +63,7 @@ runs:
   using: "composite"
   steps:
     - if: ${{ inputs.release-notes-assistant }}
-      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+      uses: https://data.forgejo.org/actions/cache@v4
       with:
         key: rna-${{ inputs.repo }}
         path: ${{ forge.action_path }}/rna
diff --git a/forgejo-release.sh b/forgejo-release.sh
index 1c01f37..650be43 100755
--- a/forgejo-release.sh
+++ b/forgejo-release.sh
@@ -12,22 +12,34 @@ if ${VERBOSE:-false}; then set -x; fi
 : ${DOWNLOAD_LATEST:=false}
 : ${TMP_DIR:=$(mktemp -d)}
 : ${GNUPGHOME:=$TMP_DIR}
+: ${TEA_BIN:=$TMP_DIR/tea}
+: ${TEA_VERSION:=0.10.1}
 : ${OVERRIDE:=false}
 : ${HIDE_ARCHIVE_LINK:=false}
 : ${RETRY:=1}
 : ${DELAY:=10}
 : ${SKIP_ASSETS:=false}
 
-RELEASE_NOTES_ASSISTANT_VERSION=v1.7.3 # renovate: datasource=forgejo-releases depName=forgejo/release-notes-assistant registryUrl=https://code.forgejo.org
+RELEASE_NOTES_ASSISTANT_VERSION=v1.5.2 # renovate: datasource=forgejo-releases depName=forgejo/release-notes-assistant registryUrl=https://code.forgejo.org
 
 TAG_FILE="$TMP_DIR/tag$$.json"
 TAG_URL=$(echo "$TAG" | sed 's/\//%2F/g')
 
 export GNUPGHOME
 
+setup_tea() {
+    if which tea 2>/dev/null; then
+        TEA_BIN=$(which tea)
+    elif ! test -f $TEA_BIN; then
+        ARCH=$(dpkg --print-architecture)
+        curl -sL https://dl.gitea.io/tea/$TEA_VERSION/tea-$TEA_VERSION-linux-"$ARCH" >$TEA_BIN
+        chmod +x $TEA_BIN
+    fi
+}
+
 get_tag() {
     if ! test -f "$TAG_FILE"; then
-        if api_json GET repos/$REPO/tags/"$TAG_URL" >"$TAG_FILE"; then
+        if api GET repos/$REPO/tags/"$TAG_URL" >"$TAG_FILE"; then
             echo "tag $TAG exists"
         else
             echo "tag $TAG does not exists"
@@ -58,52 +70,42 @@ ensure_tag() {
 }
 
 create_tag() {
-    api_json POST repos/$REPO/tags --data-raw '{"tag_name": "'"$TAG"'", "target": "'"$SHA"'"}' >"$TAG_FILE"
+    api POST repos/$REPO/tags --data-raw '{"tag_name": "'"$TAG"'", "target": "'"$SHA"'"}' >"$TAG_FILE"
 }
 
 delete_tag() {
     if get_tag; then
-        api_json DELETE repos/$REPO/tags/"$TAG_URL"
+        api DELETE repos/$REPO/tags/"$TAG_URL"
         rm -f "$TAG_FILE"
     fi
 }
 
 upload_release() {
+    # assets is defined as a list of arguments, where values may contain whitespace and need to be quoted like this -a "my file.txt" -a "file.txt".
+    # It is expanded using "${assets[@]}" which preserves the separation of arguments and not split whitespace containing values.
+    # For reference, see https://github.com/koalaman/shellcheck/wiki/SC2086#exceptions
+    local assets=()
+    if [ "$SKIP_ASSETS" == 'false' ]; then
+        for file in "$RELEASE_DIR"/*; do
+            assets=("${assets[@]}" -a "$file")
+        done
+    fi
     if $PRERELEASE || echo "${TAG}" | grep -qi '\-rc'; then
-        prerelease="true"
+        releaseType="--prerelease"
         echo "Uploading as Pre-Release"
     else
-        prerelease="false"
         echo "Uploading as Stable"
     fi
     ensure_tag
-    jq -n --arg title "$TITLE" --arg body "$RELEASENOTES" --arg tag "$TAG" --arg pre $prerelease '{"draft": true, "name": $title, "body": $body, "prerelease": $pre | test("true"), "tag_name": $tag }' >"$TMP_DIR"/release-payload.json
-    if ${VERBOSE:-false}; then
-        echo "Payload:"
-        cat "$TMP_DIR"/release-payload.json | jq
-    fi
-    if ! api_json POST repos/$REPO/releases -d @"$TMP_DIR"/release-payload.json >"$TMP_DIR"/release.json; then
-        if ${VERBOSE:-false}; then
-            echo "Response:"
-            cat "$TMP_DIR"/release.json | jq
+    if ! $TEA_BIN release create "${assets[@]}" --repo $REPO --note "$RELEASENOTES" --tag "$TAG" --title "$TITLE" --draft ${releaseType} >&"$TMP_DIR"/tea.log; then
+        if grep --quiet 'Unknown API Error: 500' "$TMP_DIR"/tea.log && grep --quiet services/release/release.go:194 "$TMP_DIR"/tea.log; then
+            echo "workaround v1.20 race condition https://codeberg.org/forgejo/forgejo/issues/1370"
+            sleep 10
+            $TEA_BIN release create "${assets[@]}" --repo $REPO --note "$RELEASENOTES" --tag "$TAG" --title "$TITLE" --draft ${releaseType}
+        else
+            cat "$TMP_DIR"/tea.log
+            return 1
         fi
-        exit 1
-    fi
-    if [ "$SKIP_ASSETS" == 'false' ]; then
-        release_id=$(jq --raw-output .id <"$TMP_DIR"/release.json)
-        for file in "$RELEASE_DIR"/*; do
-            # https://dev.to/pkutaj/how-to-use-jq-for-uri-encoding-2o5
-            # https://unix.stackexchange.com/questions/94295/shellcheck-is-advising-not-to-use-basename-why/94307#94307
-            # url encode some chars
-            asset_name="$(echo -n "${file##*/}" | jq -sRr @uri)"
-            if ! api POST "repos/$REPO/releases/$release_id/assets?name=$asset_name" -H "Content-Type: multipart/form-data" -F "attachment=@$file" >"$TMP_DIR/release-$asset_name.json"; then
-                if ${VERBOSE:-false}; then
-                    echo "Response:"
-                    cat "$TMP_DIR/release-$asset_name.json" | jq
-                fi
-                exit 1
-            fi
-        done
     fi
     maybe_use_release_note_assistant
     release_draft false
@@ -112,9 +114,9 @@ upload_release() {
 release_draft() {
     local state="$1"
 
-    local id=$(api_json GET repos/$REPO/releases/tags/"$TAG_URL" | jq --raw-output .id)
+    local id=$(api GET repos/$REPO/releases/tags/"$TAG_URL" | jq --raw-output .id)
 
-    api_json PATCH repos/$REPO/releases/"$id" --data-raw '{"draft": '"$state"', "hide_archive_links": '$HIDE_ARCHIVE_LINK'}'
+    api PATCH repos/$REPO/releases/"$id" --data-raw '{"draft": '"$state"', "hide_archive_links": '$HIDE_ARCHIVE_LINK'}'
 }
 
 maybe_use_release_note_assistant() {
@@ -150,7 +152,7 @@ maybe_override() {
     if test "$OVERRIDE" = "false"; then
         return
     fi
-    api_json DELETE repos/$REPO/releases/tags/"$TAG_URL" >&/dev/null || true
+    api DELETE repos/$REPO/releases/tags/"$TAG_URL" >&/dev/null || true
     if get_tag && ! matched_tag; then
         delete_tag
     fi
@@ -158,6 +160,9 @@ maybe_override() {
 
 upload() {
     setup_api
+    setup_tea
+    rm -f ~/.config/tea/config.yml
+    GITEA_SERVER_TOKEN=$TOKEN $TEA_BIN login add --url $FORGEJO
     maybe_sign_release
     maybe_override
     upload_release
@@ -170,23 +175,19 @@ setup_api() {
     fi
 }
 
-api_json() {
-    api "$@" -H "Content-Type: application/json"
-}
-
 api() {
     method=$1
     shift
     path=$1
     shift
 
-    curl --retry 5 --fail -X "$method" -sS -H "Authorization: token $TOKEN" "$@" $FORGEJO/api/v1/"$path"
+    curl --fail -X "$method" -sS -H "Content-Type: application/json" -H "Authorization: token $TOKEN" "$@" $FORGEJO/api/v1/"$path"
 }
 
 wait_release() {
     local ready=false
     for i in $(seq $RETRY); do
-        if api_json GET repos/$REPO/releases/tags/"$TAG_URL" | jq --raw-output .draft >"$TMP_DIR"/draft; then
+        if api GET repos/$REPO/releases/tags/"$TAG_URL" | jq --raw-output .draft >"$TMP_DIR"/draft; then
             if test "$(cat "$TMP_DIR"/draft)" = "false"; then
                 ready=true
                 break
@@ -211,11 +212,11 @@ download() {
         cd $RELEASE_DIR
         if [[ ${DOWNLOAD_LATEST} = "true" ]]; then
             echo "Downloading the latest release"
-            api_json GET repos/$REPO/releases/latest >"$TMP_DIR"/assets.json
+            api GET repos/$REPO/releases/latest >"$TMP_DIR"/assets.json
         elif [[ ${DOWNLOAD_LATEST} == "false" ]]; then
             wait_release
             echo "Downloading tagged release ${TAG}"
-            api_json GET repos/$REPO/releases/tags/"$TAG_URL" >"$TMP_DIR"/assets.json
+            api GET repos/$REPO/releases/tags/"$TAG_URL" >"$TMP_DIR"/assets.json
         fi
         jq --raw-output '.assets[] | "\(.browser_download_url) \(.name)"' <"$TMP_DIR"/assets.json | while read url name; do # `name` may contain whitespace, therefore, it must be last
             url=$(echo "$url" | sed "s#/download/${TAG}/#/download/${TAG_URL}/#")
diff --git a/testdata/forgejo-release-test.sh b/testdata/forgejo-release-test.sh
index 04343d2..7fe332b 100755
--- a/testdata/forgejo-release-test.sh
+++ b/testdata/forgejo-release-test.sh
@@ -4,17 +4,33 @@
 set -ex
 PS4='${BASH_SOURCE[0]}:$LINENO: ${FUNCNAME[0]}:  '
 
+test_system_tea_bin() {
+	SYSTEM_TEA_BIN=$TMP_DIR/tea
+	touch $SYSTEM_TEA_BIN && chmod +x $SYSTEM_TEA_BIN
+	export PATH=$TMP_DIR:$PATH
+    setup_tea
+	test $TEA_BIN == $SYSTEM_TEA_BIN
+}
+
+test_download_tea_bin() {
+    # assume tea is not installed on system
+    setup_tea
+    test $TEA_BIN == $TMP_DIR/tea
+}
+
 test_teardown() {
     setup_api
-    api_json DELETE repos/$REPO/releases/tags/$TAG || true
-    api_json DELETE repos/$REPO/tags/$TAG || true
+    api DELETE repos/$REPO/releases/tags/$TAG || true
+    api DELETE repos/$REPO/tags/$TAG || true
     rm -fr dist/release
+    setup_tea
+    $TEA_BIN login delete $DOER || true
 }
 
 test_reset_repo() {
     local project="$1"
-    api_json DELETE repos/$REPO || true
-    api_json POST user/repos --data-raw '{"name":"'$project'", "auto_init":true}'
+    api DELETE repos/$REPO || true
+    api POST user/repos --data-raw '{"name":"'$project'", "auto_init":true}'
     git clone $FORGEJO/$REPO $TMP_DIR/repo
     SHA=$(git -C $TMP_DIR/repo rev-parse HEAD)
 }
diff --git a/testdata/nested-upload-download/.forgejo/workflows/test.yml b/testdata/nested-upload-download/.forgejo/workflows/test.yml
index 52db915..8bc0a31 100644
--- a/testdata/nested-upload-download/.forgejo/workflows/test.yml
+++ b/testdata/nested-upload-download/.forgejo/workflows/test.yml
@@ -14,9 +14,9 @@ jobs:
   setup-forgejo:
     runs-on: self-hosted
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@v6
       - id: forgejo
-        uses: https://code.forgejo.org/actions/setup-forgejo@0191c04814b526caf141138a5567000ab08ddae0 # v3.2.0
+        uses: https://code.forgejo.org/actions/setup-forgejo@v3.1.4
         with:
           user: testuser
           password: admin1234
diff --git a/testdata/release-notes-file/.forgejo/workflows/test.yml b/testdata/release-notes-file/.forgejo/workflows/test.yml
index ff214ad..03660fe 100644
--- a/testdata/release-notes-file/.forgejo/workflows/test.yml
+++ b/testdata/release-notes-file/.forgejo/workflows/test.yml
@@ -6,7 +6,7 @@ jobs:
   upload-download:
     runs-on: lxc-bookworm
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@v6
       - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
         id: release-notes-file
         uses: SELF@vTest
@@ -18,7 +18,7 @@ jobs:
           release-notes-file: upload-dir/RELEASE_NOTES.md
           verbose: true
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@v6
       - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
         id: release-notes-file-takes-precedence
         uses: SELF@vTest
@@ -31,7 +31,7 @@ jobs:
           release-notes-file: upload-dir/RELEASE_NOTES.md
           verbose: true
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@v6
       - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
         id: release-notes
         uses: SELF@vTest
diff --git a/testdata/upload-download/.forgejo/workflows/gpg-no-passphrase.yml b/testdata/upload-download/.forgejo/workflows/gpg-no-passphrase.yml
index 7b02877..bfd5469 100644
--- a/testdata/upload-download/.forgejo/workflows/gpg-no-passphrase.yml
+++ b/testdata/upload-download/.forgejo/workflows/gpg-no-passphrase.yml
@@ -90,9 +90,9 @@ jobs:
   upload-gpg-no-passphrase:
     runs-on: docker
     container:
-      image: 'data.forgejo.org/oci/node:24-trixie'
+      image: 'data.forgejo.org/oci/node:24-bookworm'
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@v6
       - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
         id: release-upload
         uses: SELF@vTest
diff --git a/testdata/upload-download/.forgejo/workflows/gpg.yml b/testdata/upload-download/.forgejo/workflows/gpg.yml
index 3c8727f..ea94668 100644
--- a/testdata/upload-download/.forgejo/workflows/gpg.yml
+++ b/testdata/upload-download/.forgejo/workflows/gpg.yml
@@ -27,7 +27,7 @@ jobs:
   upload-gpg:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@v6
       - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
         id: release-upload
         uses: SELF@vTest
diff --git a/testdata/upload-download/.forgejo/workflows/test.yml b/testdata/upload-download/.forgejo/workflows/test.yml
index acde197..518e019 100644
--- a/testdata/upload-download/.forgejo/workflows/test.yml
+++ b/testdata/upload-download/.forgejo/workflows/test.yml
@@ -6,7 +6,7 @@ jobs:
   upload-download:
     runs-on: lxc-bookworm
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@v6
       - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
         id: release-upload
         uses: SELF@vTest