diff --git a/services/webhook/sourcehut/builds.go b/services/webhook/sourcehut/builds.go
index 68a9fee65b..346ccd3c0b 100644
--- a/services/webhook/sourcehut/builds.go
+++ b/services/webhook/sourcehut/builds.go
@@ -289,16 +289,21 @@ func adjustManifest(repo *api.Repository, commitID, gitRef string, r io.Reader,
 	manifest.Environment["BUILD_SUBMITTER_URL"] = setting.AppURL
 	manifest.Environment["GIT_REF"] = gitRef
 
-	source := repo.CloneURL + "#" + commitID
 	found := false
 	for i, s := range manifest.Sources {
-		if s == repo.CloneURL {
-			manifest.Sources[i] = source
+		if s == repo.CloneURL || s == repo.SSHURL {
+			manifest.Sources[i] = s + "#" + commitID
 			found = true
 			break
 		}
 	}
 	if !found {
+		source := repo.CloneURL
+		if repo.Private || setting.Repository.DisableHTTPGit {
+			// default to ssh for private repos or when git clone is disabled over http
+			source = repo.SSHURL
+		}
+		source += "#" + commitID
 		manifest.Sources = append(manifest.Sources, source)
 	}
 
diff --git a/services/webhook/sourcehut/builds_test.go b/services/webhook/sourcehut/builds_test.go
index 0f1559fd0f..5b16f08c09 100644
--- a/services/webhook/sourcehut/builds_test.go
+++ b/services/webhook/sourcehut/builds_test.go
@@ -460,6 +460,57 @@ environment:
     BUILD_SUBMITTER_URL: https://example.forgejo.org/
     GIT_REF: refs/heads/main
 image: alpine/edge
+tasks:
+    - hello: echo world
+`, string(manifest))
+	})
+
+	t.Run("with ssh source", func(t *testing.T) {
+		repo := &api.Repository{
+			CloneURL: "http://localhost:3000/testdata/repo.git",
+			SSHURL:   "git@localhost:testdata/repo.git",
+		}
+
+		manifest, err := adjustManifest(repo, "58771003157b81abc6bf41df0c5db4147a3e3c83", "refs/heads/main", strings.NewReader(`image: alpine/edge
+sources:
+- git@localhost:testdata/repo.git
+- http://other.example.conm/repo.git
+tasks:
+    - hello: echo world`), ".build.yml")
+
+		require.NoError(t, err)
+		assert.Equal(t, `sources:
+    - git@localhost:testdata/repo.git#58771003157b81abc6bf41df0c5db4147a3e3c83
+    - http://other.example.conm/repo.git
+environment:
+    BUILD_SUBMITTER: forgejo
+    BUILD_SUBMITTER_URL: https://example.forgejo.org/
+    GIT_REF: refs/heads/main
+image: alpine/edge
+tasks:
+    - hello: echo world
+`, string(manifest))
+	})
+
+	t.Run("private without source", func(t *testing.T) {
+		repo := &api.Repository{
+			CloneURL: "http://localhost:3000/testdata/repo.git",
+			SSHURL:   "git@localhost:testdata/repo.git",
+			Private:  true,
+		}
+
+		manifest, err := adjustManifest(repo, "58771003157b81abc6bf41df0c5db4147a3e3c83", "refs/heads/main", strings.NewReader(`image: alpine/edge
+tasks:
+    - hello: echo world`), ".build.yml")
+
+		require.NoError(t, err)
+		assert.Equal(t, `sources:
+    - git@localhost:testdata/repo.git#58771003157b81abc6bf41df0c5db4147a3e3c83
+environment:
+    BUILD_SUBMITTER: forgejo
+    BUILD_SUBMITTER_URL: https://example.forgejo.org/
+    GIT_REF: refs/heads/main
+image: alpine/edge
 tasks:
     - hello: echo world
 `, string(manifest))