diff --git a/gitea/cache-server-config.yaml b/gitea/cache-server-config.yaml
deleted file mode 100644
index c2050f9..0000000
--- a/gitea/cache-server-config.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-cache:
-  # Path to the shared secret file (generated on the VPS directly, outside
-  # git - see /root/stacks/.data/gitea/cache_secret). Must match
-  # external_secret_file in runner-config.yaml exactly.
-  external_secret_file: "/data/cache_secret"
diff --git a/gitea/compose.yml b/gitea/compose.yml
index 026cd1d..87bc85f 100644
--- a/gitea/compose.yml
+++ b/gitea/compose.yml
@@ -110,8 +110,13 @@ services:
       - "8088:8088"
     volumes:
       - ../.data/gitea/runner-cache:/data/cache
-      - ./cache-server-config.yaml:/data/config.yaml:ro
-      - ../.data/gitea/cache_secret:/data/cache_secret:ro
+      # Unlike the daemon (runner-config.yaml, external_secret_file works
+      # fine there), the cache-server subcommand only checks the literal
+      # external_secret field and errors out ("must be set") if only
+      # external_secret_file is given. So this file has to hold the actual
+      # secret value - kept out of git entirely, generated straight into
+      # .data on the VPS (see the cache_secret file it reads from).
+      - ../.data/gitea/cache-server-config.yaml:/data/config.yaml:ro
     restart: always
     networks:
       - compose_network