diff --git a/.gitea/workflows/gates.yml b/.gitea/workflows/gates.yml
index b158f14..86a27e7 100644
--- a/.gitea/workflows/gates.yml
+++ b/.gitea/workflows/gates.yml
@@ -84,7 +84,11 @@ jobs:
           req = urllib.request.Request(
               "https://api.resend.com/emails", data=body, method="POST",
               headers={"Authorization": "Bearer %s" % key,
-                       "Content-Type": "application/json"})
+                       "Content-Type": "application/json",
+                       # Cloudflare fronts api.resend.com and BLOCKS the default
+                       # "Python-urllib/3.x" agent with its own 403 (error 1010) — which looks
+                       # exactly like an auth failure and is not one. Measured 2026-08-02.
+                       "User-Agent": "felhom-ci/1.0"})
           try:
               with urllib.request.urlopen(req, timeout=30) as r:
                   print("RESEND-ACCEPTED id=%s" % json.load(r)["id"])