diff --git a/templates/3d-printing/VERSION b/templates/3d-printing/VERSION
index 0cfbf08..00750ed 100644
--- a/templates/3d-printing/VERSION
+++ b/templates/3d-printing/VERSION
@@ -1 +1 @@
-2
+3
diff --git a/templates/3d-printing/cli-setup-wizard.sh b/templates/3d-printing/cli-setup-wizard.sh
index f50d0c3..74f4b00 100644
--- a/templates/3d-printing/cli-setup-wizard.sh
+++ b/templates/3d-printing/cli-setup-wizard.sh
@@ -149,6 +149,62 @@ fi
 # for an OAuth login) vary by auth method.
 command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
 
+# --- Git credential helper for Gitea, backed by tea's own login ---
+# Coder injects GIT_ASKPASS to answer git's own credential prompts, but it
+# only recognizes external auth providers it knows about (github.com is
+# configured on the Coder deployment itself) - for any other host it falls
+# through to a broken interactive prompt that just hangs a non-interactive
+# git subprocess. A credential helper that successfully answers
+# `git credential fill` runs *before* GIT_ASKPASS is ever consulted, so
+# registering one for git.octoturge.com sidesteps that broken path
+# entirely, without touching how Coder handles github.com.
+#
+# The token itself lives in tea's own store
+# (~/.config/tea/credentials.json), which tea keeps fresh (via its
+# refresh_token) as a side effect of any authenticated call - this helper
+# never keeps its own copy, just re-reads tea's live value every time git
+# asks.
+if [ "$DID_GITEA" -eq 1 ]; then
+  GITEA_LOGIN_NAME="$(awk '
+    /^[[:space:]]*- name:/ { name = $NF }
+    /url: https:\/\/git\.octoturge\.com/ { print name; exit }
+  ' "$HOME/.config/tea/config.yml" 2>/dev/null)"
+
+  if [ -n "$GITEA_LOGIN_NAME" ]; then
+    mkdir -p "$HOME/.local/bin"
+    HELPER="$HOME/.local/bin/git-credential-gitea-tea"
+    cat > "$HELPER" <<'HELPER_EOT'
+#!/bin/sh
+# Auto-generated by cli-setup-wizard.sh - re-run the wizard with --force to
+# regenerate this after logging into a different Gitea account.
+LOGIN_NAME="__GITEA_LOGIN_NAME__"
+CRED_FILE="$HOME/.config/tea/credentials.json"
+
+case "$1" in
+  get)
+    # Authenticated no-op call: gives tea a chance to refresh and persist
+    # an expired access_token before we read it below.
+    tea whoami >/dev/null 2>&1
+    token="$(grep -oP "(?<=\"$LOGIN_NAME\":).*" "$CRED_FILE" 2>/dev/null \
+      | grep -oP '(?<=access_token\\":\\")[^\\"]*' | head -n1)"
+    if [ -n "$token" ]; then
+      echo "username=oauth2"
+      echo "password=$token"
+    fi
+    ;;
+  store|erase)
+    # No-op: credentials.json (managed by tea) is the single source of
+    # truth, nothing for git to persist or clear on this end.
+    ;;
+esac
+HELPER_EOT
+    sed -i "s/__GITEA_LOGIN_NAME__/$GITEA_LOGIN_NAME/" "$HELPER"
+    chmod +x "$HELPER"
+    git config --global credential."https://git.octoturge.com".helper "$HELPER"
+    echo "Configured git to push/pull https://git.octoturge.com using your tea login."
+  fi
+fi
+
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
 # stays silent for "local git only" (neither was set up).
diff --git a/templates/cobol/VERSION b/templates/cobol/VERSION
index 0cfbf08..00750ed 100644
--- a/templates/cobol/VERSION
+++ b/templates/cobol/VERSION
@@ -1 +1 @@
-2
+3
diff --git a/templates/cobol/cli-setup-wizard.sh b/templates/cobol/cli-setup-wizard.sh
index f50d0c3..74f4b00 100644
--- a/templates/cobol/cli-setup-wizard.sh
+++ b/templates/cobol/cli-setup-wizard.sh
@@ -149,6 +149,62 @@ fi
 # for an OAuth login) vary by auth method.
 command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
 
+# --- Git credential helper for Gitea, backed by tea's own login ---
+# Coder injects GIT_ASKPASS to answer git's own credential prompts, but it
+# only recognizes external auth providers it knows about (github.com is
+# configured on the Coder deployment itself) - for any other host it falls
+# through to a broken interactive prompt that just hangs a non-interactive
+# git subprocess. A credential helper that successfully answers
+# `git credential fill` runs *before* GIT_ASKPASS is ever consulted, so
+# registering one for git.octoturge.com sidesteps that broken path
+# entirely, without touching how Coder handles github.com.
+#
+# The token itself lives in tea's own store
+# (~/.config/tea/credentials.json), which tea keeps fresh (via its
+# refresh_token) as a side effect of any authenticated call - this helper
+# never keeps its own copy, just re-reads tea's live value every time git
+# asks.
+if [ "$DID_GITEA" -eq 1 ]; then
+  GITEA_LOGIN_NAME="$(awk '
+    /^[[:space:]]*- name:/ { name = $NF }
+    /url: https:\/\/git\.octoturge\.com/ { print name; exit }
+  ' "$HOME/.config/tea/config.yml" 2>/dev/null)"
+
+  if [ -n "$GITEA_LOGIN_NAME" ]; then
+    mkdir -p "$HOME/.local/bin"
+    HELPER="$HOME/.local/bin/git-credential-gitea-tea"
+    cat > "$HELPER" <<'HELPER_EOT'
+#!/bin/sh
+# Auto-generated by cli-setup-wizard.sh - re-run the wizard with --force to
+# regenerate this after logging into a different Gitea account.
+LOGIN_NAME="__GITEA_LOGIN_NAME__"
+CRED_FILE="$HOME/.config/tea/credentials.json"
+
+case "$1" in
+  get)
+    # Authenticated no-op call: gives tea a chance to refresh and persist
+    # an expired access_token before we read it below.
+    tea whoami >/dev/null 2>&1
+    token="$(grep -oP "(?<=\"$LOGIN_NAME\":).*" "$CRED_FILE" 2>/dev/null \
+      | grep -oP '(?<=access_token\\":\\")[^\\"]*' | head -n1)"
+    if [ -n "$token" ]; then
+      echo "username=oauth2"
+      echo "password=$token"
+    fi
+    ;;
+  store|erase)
+    # No-op: credentials.json (managed by tea) is the single source of
+    # truth, nothing for git to persist or clear on this end.
+    ;;
+esac
+HELPER_EOT
+    sed -i "s/__GITEA_LOGIN_NAME__/$GITEA_LOGIN_NAME/" "$HELPER"
+    chmod +x "$HELPER"
+    git config --global credential."https://git.octoturge.com".helper "$HELPER"
+    echo "Configured git to push/pull https://git.octoturge.com using your tea login."
+  fi
+fi
+
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
 # stays silent for "local git only" (neither was set up).
diff --git a/templates/default/VERSION b/templates/default/VERSION
index 0cfbf08..00750ed 100644
--- a/templates/default/VERSION
+++ b/templates/default/VERSION
@@ -1 +1 @@
-2
+3
diff --git a/templates/default/cli-setup-wizard.sh b/templates/default/cli-setup-wizard.sh
index f50d0c3..74f4b00 100644
--- a/templates/default/cli-setup-wizard.sh
+++ b/templates/default/cli-setup-wizard.sh
@@ -149,6 +149,62 @@ fi
 # for an OAuth login) vary by auth method.
 command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
 
+# --- Git credential helper for Gitea, backed by tea's own login ---
+# Coder injects GIT_ASKPASS to answer git's own credential prompts, but it
+# only recognizes external auth providers it knows about (github.com is
+# configured on the Coder deployment itself) - for any other host it falls
+# through to a broken interactive prompt that just hangs a non-interactive
+# git subprocess. A credential helper that successfully answers
+# `git credential fill` runs *before* GIT_ASKPASS is ever consulted, so
+# registering one for git.octoturge.com sidesteps that broken path
+# entirely, without touching how Coder handles github.com.
+#
+# The token itself lives in tea's own store
+# (~/.config/tea/credentials.json), which tea keeps fresh (via its
+# refresh_token) as a side effect of any authenticated call - this helper
+# never keeps its own copy, just re-reads tea's live value every time git
+# asks.
+if [ "$DID_GITEA" -eq 1 ]; then
+  GITEA_LOGIN_NAME="$(awk '
+    /^[[:space:]]*- name:/ { name = $NF }
+    /url: https:\/\/git\.octoturge\.com/ { print name; exit }
+  ' "$HOME/.config/tea/config.yml" 2>/dev/null)"
+
+  if [ -n "$GITEA_LOGIN_NAME" ]; then
+    mkdir -p "$HOME/.local/bin"
+    HELPER="$HOME/.local/bin/git-credential-gitea-tea"
+    cat > "$HELPER" <<'HELPER_EOT'
+#!/bin/sh
+# Auto-generated by cli-setup-wizard.sh - re-run the wizard with --force to
+# regenerate this after logging into a different Gitea account.
+LOGIN_NAME="__GITEA_LOGIN_NAME__"
+CRED_FILE="$HOME/.config/tea/credentials.json"
+
+case "$1" in
+  get)
+    # Authenticated no-op call: gives tea a chance to refresh and persist
+    # an expired access_token before we read it below.
+    tea whoami >/dev/null 2>&1
+    token="$(grep -oP "(?<=\"$LOGIN_NAME\":).*" "$CRED_FILE" 2>/dev/null \
+      | grep -oP '(?<=access_token\\":\\")[^\\"]*' | head -n1)"
+    if [ -n "$token" ]; then
+      echo "username=oauth2"
+      echo "password=$token"
+    fi
+    ;;
+  store|erase)
+    # No-op: credentials.json (managed by tea) is the single source of
+    # truth, nothing for git to persist or clear on this end.
+    ;;
+esac
+HELPER_EOT
+    sed -i "s/__GITEA_LOGIN_NAME__/$GITEA_LOGIN_NAME/" "$HELPER"
+    chmod +x "$HELPER"
+    git config --global credential."https://git.octoturge.com".helper "$HELPER"
+    echo "Configured git to push/pull https://git.octoturge.com using your tea login."
+  fi
+fi
+
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
 # stays silent for "local git only" (neither was set up).
diff --git a/templates/python/VERSION b/templates/python/VERSION
index 0cfbf08..00750ed 100644
--- a/templates/python/VERSION
+++ b/templates/python/VERSION
@@ -1 +1 @@
-2
+3
diff --git a/templates/python/cli-setup-wizard.sh b/templates/python/cli-setup-wizard.sh
index f50d0c3..74f4b00 100644
--- a/templates/python/cli-setup-wizard.sh
+++ b/templates/python/cli-setup-wizard.sh
@@ -149,6 +149,62 @@ fi
 # for an OAuth login) vary by auth method.
 command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
 
+# --- Git credential helper for Gitea, backed by tea's own login ---
+# Coder injects GIT_ASKPASS to answer git's own credential prompts, but it
+# only recognizes external auth providers it knows about (github.com is
+# configured on the Coder deployment itself) - for any other host it falls
+# through to a broken interactive prompt that just hangs a non-interactive
+# git subprocess. A credential helper that successfully answers
+# `git credential fill` runs *before* GIT_ASKPASS is ever consulted, so
+# registering one for git.octoturge.com sidesteps that broken path
+# entirely, without touching how Coder handles github.com.
+#
+# The token itself lives in tea's own store
+# (~/.config/tea/credentials.json), which tea keeps fresh (via its
+# refresh_token) as a side effect of any authenticated call - this helper
+# never keeps its own copy, just re-reads tea's live value every time git
+# asks.
+if [ "$DID_GITEA" -eq 1 ]; then
+  GITEA_LOGIN_NAME="$(awk '
+    /^[[:space:]]*- name:/ { name = $NF }
+    /url: https:\/\/git\.octoturge\.com/ { print name; exit }
+  ' "$HOME/.config/tea/config.yml" 2>/dev/null)"
+
+  if [ -n "$GITEA_LOGIN_NAME" ]; then
+    mkdir -p "$HOME/.local/bin"
+    HELPER="$HOME/.local/bin/git-credential-gitea-tea"
+    cat > "$HELPER" <<'HELPER_EOT'
+#!/bin/sh
+# Auto-generated by cli-setup-wizard.sh - re-run the wizard with --force to
+# regenerate this after logging into a different Gitea account.
+LOGIN_NAME="__GITEA_LOGIN_NAME__"
+CRED_FILE="$HOME/.config/tea/credentials.json"
+
+case "$1" in
+  get)
+    # Authenticated no-op call: gives tea a chance to refresh and persist
+    # an expired access_token before we read it below.
+    tea whoami >/dev/null 2>&1
+    token="$(grep -oP "(?<=\"$LOGIN_NAME\":).*" "$CRED_FILE" 2>/dev/null \
+      | grep -oP '(?<=access_token\\":\\")[^\\"]*' | head -n1)"
+    if [ -n "$token" ]; then
+      echo "username=oauth2"
+      echo "password=$token"
+    fi
+    ;;
+  store|erase)
+    # No-op: credentials.json (managed by tea) is the single source of
+    # truth, nothing for git to persist or clear on this end.
+    ;;
+esac
+HELPER_EOT
+    sed -i "s/__GITEA_LOGIN_NAME__/$GITEA_LOGIN_NAME/" "$HELPER"
+    chmod +x "$HELPER"
+    git config --global credential."https://git.octoturge.com".helper "$HELPER"
+    echo "Configured git to push/pull https://git.octoturge.com using your tea login."
+  fi
+fi
+
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
 # stays silent for "local git only" (neither was set up).
diff --git a/templates/ttrpg/VERSION b/templates/ttrpg/VERSION
index 0cfbf08..00750ed 100644
--- a/templates/ttrpg/VERSION
+++ b/templates/ttrpg/VERSION
@@ -1 +1 @@
-2
+3
diff --git a/templates/ttrpg/cli-setup-wizard.sh b/templates/ttrpg/cli-setup-wizard.sh
index f50d0c3..74f4b00 100644
--- a/templates/ttrpg/cli-setup-wizard.sh
+++ b/templates/ttrpg/cli-setup-wizard.sh
@@ -149,6 +149,62 @@ fi
 # for an OAuth login) vary by auth method.
 command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
 
+# --- Git credential helper for Gitea, backed by tea's own login ---
+# Coder injects GIT_ASKPASS to answer git's own credential prompts, but it
+# only recognizes external auth providers it knows about (github.com is
+# configured on the Coder deployment itself) - for any other host it falls
+# through to a broken interactive prompt that just hangs a non-interactive
+# git subprocess. A credential helper that successfully answers
+# `git credential fill` runs *before* GIT_ASKPASS is ever consulted, so
+# registering one for git.octoturge.com sidesteps that broken path
+# entirely, without touching how Coder handles github.com.
+#
+# The token itself lives in tea's own store
+# (~/.config/tea/credentials.json), which tea keeps fresh (via its
+# refresh_token) as a side effect of any authenticated call - this helper
+# never keeps its own copy, just re-reads tea's live value every time git
+# asks.
+if [ "$DID_GITEA" -eq 1 ]; then
+  GITEA_LOGIN_NAME="$(awk '
+    /^[[:space:]]*- name:/ { name = $NF }
+    /url: https:\/\/git\.octoturge\.com/ { print name; exit }
+  ' "$HOME/.config/tea/config.yml" 2>/dev/null)"
+
+  if [ -n "$GITEA_LOGIN_NAME" ]; then
+    mkdir -p "$HOME/.local/bin"
+    HELPER="$HOME/.local/bin/git-credential-gitea-tea"
+    cat > "$HELPER" <<'HELPER_EOT'
+#!/bin/sh
+# Auto-generated by cli-setup-wizard.sh - re-run the wizard with --force to
+# regenerate this after logging into a different Gitea account.
+LOGIN_NAME="__GITEA_LOGIN_NAME__"
+CRED_FILE="$HOME/.config/tea/credentials.json"
+
+case "$1" in
+  get)
+    # Authenticated no-op call: gives tea a chance to refresh and persist
+    # an expired access_token before we read it below.
+    tea whoami >/dev/null 2>&1
+    token="$(grep -oP "(?<=\"$LOGIN_NAME\":).*" "$CRED_FILE" 2>/dev/null \
+      | grep -oP '(?<=access_token\\":\\")[^\\"]*' | head -n1)"
+    if [ -n "$token" ]; then
+      echo "username=oauth2"
+      echo "password=$token"
+    fi
+    ;;
+  store|erase)
+    # No-op: credentials.json (managed by tea) is the single source of
+    # truth, nothing for git to persist or clear on this end.
+    ;;
+esac
+HELPER_EOT
+    sed -i "s/__GITEA_LOGIN_NAME__/$GITEA_LOGIN_NAME/" "$HELPER"
+    chmod +x "$HELPER"
+    git config --global credential."https://git.octoturge.com".helper "$HELPER"
+    echo "Configured git to push/pull https://git.octoturge.com using your tea login."
+  fi
+fi
+
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
 # stays silent for "local git only" (neither was set up).
diff --git a/templates/web/VERSION b/templates/web/VERSION
index 0cfbf08..00750ed 100644
--- a/templates/web/VERSION
+++ b/templates/web/VERSION
@@ -1 +1 @@
-2
+3
diff --git a/templates/web/cli-setup-wizard.sh b/templates/web/cli-setup-wizard.sh
index f50d0c3..74f4b00 100644
--- a/templates/web/cli-setup-wizard.sh
+++ b/templates/web/cli-setup-wizard.sh
@@ -149,6 +149,62 @@ fi
 # for an OAuth login) vary by auth method.
 command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
 
+# --- Git credential helper for Gitea, backed by tea's own login ---
+# Coder injects GIT_ASKPASS to answer git's own credential prompts, but it
+# only recognizes external auth providers it knows about (github.com is
+# configured on the Coder deployment itself) - for any other host it falls
+# through to a broken interactive prompt that just hangs a non-interactive
+# git subprocess. A credential helper that successfully answers
+# `git credential fill` runs *before* GIT_ASKPASS is ever consulted, so
+# registering one for git.octoturge.com sidesteps that broken path
+# entirely, without touching how Coder handles github.com.
+#
+# The token itself lives in tea's own store
+# (~/.config/tea/credentials.json), which tea keeps fresh (via its
+# refresh_token) as a side effect of any authenticated call - this helper
+# never keeps its own copy, just re-reads tea's live value every time git
+# asks.
+if [ "$DID_GITEA" -eq 1 ]; then
+  GITEA_LOGIN_NAME="$(awk '
+    /^[[:space:]]*- name:/ { name = $NF }
+    /url: https:\/\/git\.octoturge\.com/ { print name; exit }
+  ' "$HOME/.config/tea/config.yml" 2>/dev/null)"
+
+  if [ -n "$GITEA_LOGIN_NAME" ]; then
+    mkdir -p "$HOME/.local/bin"
+    HELPER="$HOME/.local/bin/git-credential-gitea-tea"
+    cat > "$HELPER" <<'HELPER_EOT'
+#!/bin/sh
+# Auto-generated by cli-setup-wizard.sh - re-run the wizard with --force to
+# regenerate this after logging into a different Gitea account.
+LOGIN_NAME="__GITEA_LOGIN_NAME__"
+CRED_FILE="$HOME/.config/tea/credentials.json"
+
+case "$1" in
+  get)
+    # Authenticated no-op call: gives tea a chance to refresh and persist
+    # an expired access_token before we read it below.
+    tea whoami >/dev/null 2>&1
+    token="$(grep -oP "(?<=\"$LOGIN_NAME\":).*" "$CRED_FILE" 2>/dev/null \
+      | grep -oP '(?<=access_token\\":\\")[^\\"]*' | head -n1)"
+    if [ -n "$token" ]; then
+      echo "username=oauth2"
+      echo "password=$token"
+    fi
+    ;;
+  store|erase)
+    # No-op: credentials.json (managed by tea) is the single source of
+    # truth, nothing for git to persist or clear on this end.
+    ;;
+esac
+HELPER_EOT
+    sed -i "s/__GITEA_LOGIN_NAME__/$GITEA_LOGIN_NAME/" "$HELPER"
+    chmod +x "$HELPER"
+    git config --global credential."https://git.octoturge.com".helper "$HELPER"
+    echo "Configured git to push/pull https://git.octoturge.com using your tea login."
+  fi
+fi
+
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
 # stays silent for "local git only" (neither was set up).