diff --git a/src/com/homelab/stages/updateHelmTag.groovy b/src/com/homelab/stages/updateHelmTag.groovy
index 6c36032..53a8f63 100644
--- a/src/com/homelab/stages/updateHelmTag.groovy
+++ b/src/com/homelab/stages/updateHelmTag.groovy
@@ -28,7 +28,19 @@ def run(Map config) {
         withCredentials([usernamePassword(credentialsId: config.gitea_cred ?: 'gitea-ci-credentials', usernameVariable: 'GIT_USER', passwordVariable: 'GIT_PASS')]) {
             dir('helm-chart-repo') {
                 deleteDir()
-                def authedUrl = config.helm_repo_url.replaceFirst('http://', "http://\${GIT_USER}:\${GIT_PASS}@")
+                // Plain split, not replaceFirst — replaceFirst's *replacement*
+                // argument is also parsed as regex-replacement syntax, where
+                // ${name} means "substitute named capture group", not literal
+                // text. Since \${GIT_USER}/\${GIT_PASS} are meant to stay
+                // literal here (so the *shell* expands them from the
+                // credential-bound env vars at sh-step time, not Groovy —
+                // otherwise the secret value would land in a Groovy-processed
+                // string and defeat withCredentials' masking), that collided
+                // with a pattern that has no such named group and threw
+                // `IllegalArgumentException: named capturing group is
+                // missing trailing '}'`.
+                def urlParts = config.helm_repo_url.split('://', 2)
+                def authedUrl = "${urlParts[0]}://\${GIT_USER}:\${GIT_PASS}@${urlParts[1]}"
                 sh """
                     git clone ${authedUrl} .
                     yq -i '${config.image_tag_yq_path} = "${env.TAG}"' ${valuesFile}