diff --git a/modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go b/modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go
index 9794aa394..d29a001d4 100644
--- a/modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go
+++ b/modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go
@@ -31,7 +31,20 @@ func giteaBoundExpected(internalToken, password string) string {
 		"GITEA__database__NAME=mesh_g14_gitea\n" +
 		"GITEA__database__USER=mesh_g14_gitea\n" +
 		"GITEA__database__PASSWD=" + password + "\n" +
-		"GITEA__webhook__ALLOWED_HOST_LIST=172.17.0.1\n"
+		"GITEA__webhook__ALLOWED_HOST_LIST=172.17.0.1\n" +
+		"# Issue 1966: cap the forge's own pool; the store's 100 connections are shared by every module on this machine.\n" +
+		"# SSH git operations go through the forge's private API, so this pool carries them.\n" +
+		"GITEA__database__MAX_OPEN_CONNS=40\n" +
+		"GITEA__database__MAX_IDLE_CONNS=10\n" +
+		"GITEA__database__CONN_MAX_LIFETIME=5m\n"
+}
+
+// giteaPoolConfig gives gitea the values of the three pool keys its template reads (issue 1966), as mesh-config writes them.
+func giteaPoolConfig(t *testing.T, b *aBus) {
+	t.Helper()
+	b.config(t, "gitea", "database-max-open-connections", "40")
+	b.config(t, "gitea", "database-max-idle-connections", "10")
+	b.config(t, "gitea", "database-connection-lifetime", `"5m"`)
 }
 
 func giteaRun(t *testing.T, entry string, extra string) (*engine, *aBus, *reports) {
@@ -41,6 +54,7 @@ func giteaRun(t *testing.T, entry string, extra string) (*engine, *aBus, *report
 	vault := startVault(t, b)
 	vault.keep("own/g14/gitea/internal-token", "tok-never-on-the-bus", false)
 	vault.keep("pair/novox/postgres-database/g14/gitea", "pw-never-on-the-bus", false)
+	giteaPoolConfig(t, b)
 	heard := b.listen(t)
 	e := startEngine(t, map[string]string{giteaEnvPath: "owned"})
 	tpl, _ := templates(t, map[string]string{"server.env": giteaTemplate(t) + extra})
diff --git a/modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go b/modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go
index 5576e77f6..fbde3f1b5 100644
--- a/modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go
+++ b/modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go
@@ -56,6 +56,7 @@ func TestNatsAMovedGiteaAndClaudeCodeHaveTheirFilesFilledFromTheBus(t *testing.T
 	vault.keep("own/g14/gitea/internal-token", "tok-never-on-the-bus", false)
 	vault.keep("pair/novox/postgres-database/g14/gitea", "pw-never-on-the-bus", false)
 	vault.keep(forgeHolder, credential, false)
+	giteaPoolConfig(t, b)
 	e := startEngine(t, map[string]string{serverEnv: "owned", origins: "owned", facts: "owned", readCred: "owned"})
 
 	giteaTpl, _ := templates(t, map[string]string{"server.env": catalogFile(t, "gitea/files/server.env"),