diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index af85cd6..9bdf816 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -20,12 +20,14 @@ jobs:
         id: meta
         run: echo "tag=${GITHUB_SHA::8}" >> "$GITHUB_OUTPUT"
 
+      # GITHUB_TOKEN cannot authenticate to Gitea's /v2/ registry; use a PAT
+      # with write:package stored as repo secret REGISTRY_TOKEN.
       - name: Login to Gitea container registry
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Build and push
         uses: docker/build-push-action@v6