diff --git a/internal/coreruleset/coreruleset_test.go b/internal/coreruleset/coreruleset_test.go
index 241a80d..c972e40 100644
--- a/internal/coreruleset/coreruleset_test.go
+++ b/internal/coreruleset/coreruleset_test.go
@@ -692,6 +692,17 @@ func TestOrdinaryGiteaRequestsPassAndAttacksAreRefused(t *testing.T) {
 				t.Errorf("%s let through: %+v", target, got)
 			}
 		}
+
+		// Nor is a page opened from them.
+		for _, attack := range []string{
+			"<script>alert(1)</script>",
+			"1' OR '1'='1",
+		} {
+			referer := "Referer: https://example.com" + path + "?q=" + attack
+			if got := inspect(t, crs, get("/", referer)); got.Score < threshold {
+				t.Errorf("%s let through: %+v", referer, got)
+			}
+		}
 	}
 }
 
diff --git a/internal/coreruleset/gitea.conf b/internal/coreruleset/gitea.conf
index 2736fbe..6059b24 100644
--- a/internal/coreruleset/gitea.conf
+++ b/internal/coreruleset/gitea.conf
@@ -83,17 +83,20 @@ SecRule REQUEST_FILENAME "@rx ^/(?:explore/code|issues(?:/search)?|pulls|\
 #   941160: <img src=
 #   942100: LIKE '%foo%'
 #   944100: java.lang.Runtime
+# A repository with the owner api is left out here too.
 SecRule REQUEST_HEADERS:Referer "@rx ^https?://[^/]+/(?:explore/code|\
     issues(?:/search)?|pulls|[^/]+/-/code|\
     [^/]+/[^/]+/(?:search|issues(?:/search)?|pulls|\
     commits/(?:branch|tag|commit)/.+/search)|\
     api/v1/repos/(?:issues/search|[^/]+/[^/]+/issues))\?" \
-    "id:900601,phase:1,pass,nolog,\
-    ctl:ruleRemoveTargetById=941110;REQUEST_HEADERS:Referer,\
-    ctl:ruleRemoveTargetById=941120;REQUEST_HEADERS:Referer,\
-    ctl:ruleRemoveTargetById=941160;REQUEST_HEADERS:Referer,\
-    ctl:ruleRemoveTargetById=942100;REQUEST_HEADERS:Referer,\
-    ctl:ruleRemoveTargetById=944100;REQUEST_HEADERS:Referer"
+    "id:900601,phase:1,pass,nolog,chain"
+    SecRule REQUEST_HEADERS:Referer "!@rx ^https?://[^/]+/api/[^/]+/(?:search|\
+        issues(?:/search)?|pulls|commits/(?:branch|tag|commit)/.+/search)\?" \
+        "ctl:ruleRemoveTargetById=941110;REQUEST_HEADERS:Referer,\
+        ctl:ruleRemoveTargetById=941120;REQUEST_HEADERS:Referer,\
+        ctl:ruleRemoveTargetById=941160;REQUEST_HEADERS:Referer,\
+        ctl:ruleRemoveTargetById=942100;REQUEST_HEADERS:Referer,\
+        ctl:ruleRemoveTargetById=944100;REQUEST_HEADERS:Referer"
 
 # gitea's searches of repositories, users, branches, tags and packages send a
 # name in q, which skips these rules there: