diff --git a/sso-mfa/k8s/keycape/client-profiles/forgejo-public-build.yaml b/sso-mfa/k8s/keycape/client-profiles/forgejo-public-build.yaml
new file mode 100644
index 0000000..4ffc903
--- /dev/null
+++ b/sso-mfa/k8s/keycape/client-profiles/forgejo-public-build.yaml
@@ -0,0 +1,15 @@
+# Temporary build profile; activation requires the exact CUST80-FORGEJO-PUBLIC-BUILD-20261018 approval.
+# The accepted confidential-client case remains the target; full acceptance is CUST-WP-0082-T20.
+clientId: forgejo
+displayName: Forgejo source forge
+redirectUris:
+- https://forgejo.coulomb.social/user/oauth2/netkingdom/callback
+allowedScopes:
+- openid
+- profile
+- email
+- groups
+grantTypes:
+- authorization_code
+clientType: public
+mfaRequired: true