diff --git a/.forgejo/workflows/sast.yml b/.forgejo/workflows/sast.yml
index 0f46e9c..abb14c0 100644
--- a/.forgejo/workflows/sast.yml
+++ b/.forgejo/workflows/sast.yml
@@ -20,9 +20,12 @@ jobs:
       - name: semgrep
         env:
           CONFIGS: ${{ inputs.config }}
+          # The env var, not --metrics=off: semgrep 1.90 still prints its
+          # "reports pseudonymous rule metrics" notice for registry configs
+          # when given only the flag, and does not with the env var.
           SEMGREP_SEND_METRICS: "off"
         run: |
           semgrep --version
-          set -- scan --error --metrics=off --disable-version-check
+          set -- scan --error --disable-version-check
           for c in $CONFIGS; do set -- "$@" --config "$c"; done
           semgrep "$@"