diff --git a/services/dev/gitea.nix b/services/dev/gitea.nix
index 7cdb25e..9b929e2 100644
--- a/services/dev/gitea.nix
+++ b/services/dev/gitea.nix
@@ -102,6 +102,24 @@ in
 
   networking.firewall.allowedTCPPorts = [ 2222 ];
 
+  # `gitea <args>` == the admin CLI, as the gitea user, against the real
+  # state dir — mirrors the `hermes` alias on mars. Worth having because none
+  # of that is discoverable: the package is not in systemPackages (so `gitea`
+  # is not otherwise on PATH at all), every admin subcommand needs
+  # GITEA_WORK_DIR pointed at a stateDir that is not the module default, and
+  # it has to run as the gitea user or it writes root-owned files into that
+  # directory. Both paths come from the config rather than being spelled out,
+  # so a package bump or a stateDir move cannot leave this stale.
+  #
+  # Handy ones:
+  #   gitea admin user generate-access-token --username luna \
+  #     --token-name luna-$(date +%Y%m%d) \
+  #     --scopes write:repository,write:issue,read:user --raw
+  #   gitea admin user list
+  #   gitea actions generate-runner-token
+  programs.zsh.shellAliases.gitea =
+    "sudo -u ${config.services.gitea.user} env GITEA_WORK_DIR=${config.services.gitea.stateDir} ${config.services.gitea.package}/bin/gitea";
+
   users.users.gitea.extraGroups = [ "users" ];
 
   # Runner instance registered against this same gitea. Jobs run in containers