diff --git a/src/gitea_proxy.py b/src/gitea_proxy.py
index b1578fc..70f62ef 100644
--- a/src/gitea_proxy.py
+++ b/src/gitea_proxy.py
@@ -42,10 +42,26 @@ async def activity_events() -> list[dict]:
     events = await fetch(f"users/{user['login']}/activities/feeds?limit=20")
     return [
         {
-            "type": event.get("op_type", "activity"),
-            "actor": event.get("act_user") or {},
-            "repo": event.get("repo") or {},
-            "created_at": event.get("created", ""),
+            "type": (
+                event.get("op_type")
+                if isinstance(event.get("op_type"), str) and event.get("op_type")
+                else "activity"
+            ),
+            "actor": (
+                event.get("act_user")
+                if isinstance(event.get("act_user"), dict)
+                else {}
+            ),
+            "repo": (
+                event.get("repo")
+                if isinstance(event.get("repo"), dict)
+                else {}
+            ),
+            "created_at": (
+                event.get("created")
+                if isinstance(event.get("created"), str)
+                else ""
+            ),
         }
         for event in (events or [])
         if isinstance(event, dict)
diff --git a/tests/test_event_stream.py b/tests/test_event_stream.py
index ceee7ff..3bd5a3e 100644
--- a/tests/test_event_stream.py
+++ b/tests/test_event_stream.py
@@ -162,3 +162,27 @@ async def test_activity_events_normalizes_null_feed_payload(monkeypatch):
     monkeypatch.setattr(gitea_proxy, "fetch", fake_fetch)
 
     assert await gitea_proxy.activity_events() == []
+
+
+@pytest.mark.anyio
+async def test_activity_events_normalizes_malformed_nested_metadata(monkeypatch):
+    async def fake_current_user():
+        return {"login": "timmy"}
+
+    async def fake_fetch(path):
+        return [{
+            "op_type": None,
+            "act_user": "unknown",
+            "repo": None,
+            "created": None,
+        }]
+
+    monkeypatch.setattr(gitea_proxy, "current_user", fake_current_user)
+    monkeypatch.setattr(gitea_proxy, "fetch", fake_fetch)
+
+    assert await gitea_proxy.activity_events() == [{
+        "type": "activity",
+        "actor": {},
+        "repo": {},
+        "created_at": "",
+    }]