diff --git a/config/platform-infra/gitea.yaml b/config/platform-infra/gitea.yaml
index 90f6bac9..0c5443f3 100644
--- a/config/platform-infra/gitea.yaml
+++ b/config/platform-infra/gitea.yaml
@@ -174,6 +174,8 @@ app:
     path: /var/lib/gitea/gitea.db
   actions:
     enabled: true
+  webhook:
+    allowedHostList: private,loopback
   registration:
     disabled: true
   storage:
diff --git a/scripts/src/platform-infra-gitea.ts b/scripts/src/platform-infra-gitea.ts
index 7d224591..b2236866 100644
--- a/scripts/src/platform-infra-gitea.ts
+++ b/scripts/src/platform-infra-gitea.ts
@@ -101,6 +101,9 @@ interface GiteaConfig {
     actions: {
       enabled: boolean;
     };
+    webhook: {
+      allowedHostList: string;
+    };
     registration: {
       disabled: boolean;
     };
@@ -277,6 +280,7 @@ function readGiteaConfig(): GiteaConfig {
   const server = y.objectField(app, "server", "app");
   const database = y.objectField(app, "database", "app");
   const actions = y.objectField(app, "actions", "app");
+  const webhook = y.objectField(app, "webhook", "app");
   const registration = y.objectField(app, "registration", "app");
   const storage = y.objectField(app, "storage", "app");
   const dataStorage = y.objectField(storage, "data", "app.storage");
@@ -357,6 +361,9 @@ function readGiteaConfig(): GiteaConfig {
       actions: {
         enabled: y.booleanField(actions, "enabled", "app.actions"),
       },
+      webhook: {
+        allowedHostList: y.stringField(webhook, "allowedHostList", "app.webhook"),
+      },
       registration: {
         disabled: y.booleanField(registration, "disabled", "app.registration"),
       },
@@ -928,6 +935,7 @@ function envVars(gitea: GiteaConfig, target: GiteaTarget): string {
     GITEA__database__PATH: app.database.path,
     GITEA__repository__ROOT: `${app.storage.data.mountPath}/git/repositories`,
     GITEA__actions__ENABLED: app.actions.enabled ? "true" : "false",
+    GITEA__webhook__ALLOWED_HOST_LIST: app.webhook.allowedHostList,
     GITEA__service__DISABLE_REGISTRATION: app.registration.disabled ? "true" : "false",
     GITEA__log__LEVEL: "Info",
     UNIDESK_GITEA_TARGET: target.id,