diff --git a/modules/gitea/client.ts b/modules/gitea/client.ts
index 78648b3fb..d7402f378 100644
--- a/modules/gitea/client.ts
+++ b/modules/gitea/client.ts
@@ -413,9 +413,10 @@ export class GiteaClient {
       const pull = await this.getPullRequest(found.owner, found.name, found.number);
       if (pull.state !== "open" || !pull.head_sha) continue;
       // The base's protection as the forge applies it to that branch (appliedProtection): readable without administration.
-      const base = `${full}:${pull.base || "main"}`;
-      if (!rules.has(base)) rules.set(base, await this.appliedProtection(found.owner, found.name, pull.base || "main").catch(() => undefined));
-      const rule = rules.get(base);
+      // A pull request the forge gave no base is not guessed one (design 47 §7): its protection is unknown.
+      const base = `${full}:${pull.base ?? ""}`;
+      if (pull.base && !rules.has(base)) rules.set(base, await this.appliedProtection(found.owner, found.name, pull.base).catch(() => undefined));
+      const rule = pull.base ? rules.get(base) : undefined;
       const checks = await this.headChecks(found.owner, found.name, pull.head_sha);
       const labels = found.labels ?? [];
       out.push({ owner: found.owner, repo: found.name, number: pull.number, base: pull.base ?? "", head: pull.head, head_sha: pull.head_sha,
diff --git a/modules/gitea/index.ts b/modules/gitea/index.ts
index 37c897c3a..d5ff40722 100644
--- a/modules/gitea/index.ts
+++ b/modules/gitea/index.ts
@@ -275,7 +275,7 @@ async function announceHead(client: GiteaClient, repo: RepoOf, pull: OpenOf): Pr
   // where it is: in the build queue from now, until a build machine takes it (novox/hq issue 446). Only where the base
   // still requires mesh/merge-gate (issue 1301): a main that requires mesh/check is the checker's;
   // a rule that cannot be read is said pending, as before.
-  const rule = await client.appliedProtection(repo.owner, repo.name, String(pull.base || "main")).catch(() => undefined);
+  const rule = pull.base ? await client.appliedProtection(repo.owner, repo.name, String(pull.base)).catch(() => undefined) : undefined;
   if (writesGate(requiredOf(rule))) await gates.pending(repo.owner, repo.name, sha);
   return true;
 }