Updating GitHub pull mirror authorization is not working

I had some GitHub → Gitea pull mirrors working, but I need to rotate the GitHub token. I could not find any documentation about how to do this, but I narrowed it down to the Mirror Settings part of the Settings page in the repository.

The Mirror Settings page shows:
Clone from URL: https://github.com/g-a-c/myrepo.git
Authorization/Username: oauth2
Authorization/Password: (Unchanged)

I then paste my new GitHub Personal Access Token into the Password box, and click the Update Settings button below the Password field. I get a green message saying “The repository settings have been updated.”

I have verified that the HTTPS POST to https://gitea.mydomain.com/g-a-c/myrepo/settings does contain the new token in the mirror_password field of the form data.

However. When I check the gitea.log file, I still see a SQL update happening with the old token.

2022/09/05 21:43:51 .../web/repo/setting.go:237:SettingsPost() [I] [63166d97] [SQL] UPDATE `repository` SET `original_url` = ?, `updated_unix` = ? WHERE `id`=? [https://oauth2:ghp_REDACTED_OLD_TOKEN@github.com/g-a-c/myrepo.git 1662414231 87] - 6.627054ms

When I look inside the SQLite database manually, I see the old token assigned to repo 87

sqlite> select id,name,original_url,is_mirror from repository where id=87;
87|myrepo|https://oauth2:ghp_REDACTED_OLD_TOKEN@github.com/g-a-c/myrepo.git|1

And when I check the Git config file on the container filesystem, I see the old token

[remote "origin"]
        url = https://oauth2:ghp_REDACTED_OLD_TOKEN@github.com/g-a-c/myrepo.git

I’m running Gitea v1.17.1, inside a Docker container, with a SQLite database, behind Traefik as a reverse proxy.