diff --git a/README.md b/README.md
index 4c60b3c..a91bc89 100644
--- a/README.md
+++ b/README.md
@@ -323,6 +323,13 @@ SSH passthrough for containers uses a shim script:
 - `/usr/libexec/gitea-keys` - calls `podman exec` into the container
 - `/usr/libexec/gitea-container` - shim so `gitea` CLI commands work from host
 
+The shim must exec the image's `/usr/local/bin/gitea` wrapper, not the raw
+`/app/gitea/gitea` binary. The wrapper adds `-c $GITEA_APP_INI`
+(`/etc/gitea/app.ini`) unless `-c`/`--config` is given; the raw binary ignores
+`GITEA_APP_INI` and fails with "Unable to load config file for a installed
+Gitea instance". `/etc/sudoers.d/gitea` allows only that exact command path,
+so keep both in sync.
+
 ```
 # /etc/ssh/sshd_config.d/50-gitea.conf (container variant)
 Match User git
diff --git a/gitea-shim b/gitea-shim
index 17a0c76..52e8a5d 100644
--- a/gitea-shim
+++ b/gitea-shim
@@ -1,2 +1,2 @@
 #!/bin/sh
-exec sudo /usr/bin/podman exec -i gitea /app/gitea/gitea "$@"
+exec sudo /usr/bin/podman exec -i gitea /usr/local/bin/gitea "$@"
diff --git a/gitea-sudoers b/gitea-sudoers
index 15e323a..bc41c81 100644
--- a/gitea-sudoers
+++ b/gitea-sudoers
@@ -1 +1 @@
-git ALL=(root) NOPASSWD: /usr/bin/podman exec -i gitea /app/gitea/gitea *
+git ALL=(root) NOPASSWD: /usr/bin/podman exec -i gitea /usr/local/bin/gitea *
diff --git a/gitea.spec b/gitea.spec
index 50fa5e0..0e7d7e9 100644
--- a/gitea.spec
+++ b/gitea.spec
@@ -1,6 +1,6 @@
 Name:           gitea
 Version:        28.2.0
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        Gitea - Git with a cup of tea
 License:        MIT
 Group:          System Environment/Base
@@ -214,6 +214,11 @@ fi
 %config(noreplace) %{_sysconfdir}/containers/systemd/gitea-db.container.d/credentials.conf
 
 %changelog
+* Sat Oct 31 2026 Zoran Pericic <zpericic@netst.org> - 28.2.0-3
+- gitea-container shim and sudoers: exec the image's /usr/local/bin/gitea
+  wrapper instead of /app/gitea/gitea, so /etc/gitea/app.ini is used without
+  --config
+
 * Thu Oct 29 2026 Zoran Pericic <zpericic@netst.org> - 28.2.0-2
 - Add Ulimit=nofile=65536:65536 to gitea.container
 - Ship gitea.service.d/database.conf dependency template in /etc/systemd/system