diff --git a/.gitea/workflows/docker-publish.yml b/.gitea/workflows/docker-publish.yml
index 37d237c..42e155a 100644
--- a/.gitea/workflows/docker-publish.yml
+++ b/.gitea/workflows/docker-publish.yml
@@ -48,10 +48,10 @@ jobs:
         uses: docker/login-action@v3
         with:
           registry: ${{ env.GITEA_REGISTRY }}
-          username: ${{ github.actor }}
-          # Gitea's per-job token; grant it package write access, or swap
-          # this for a PAT secret if your instance doesn't wire that up.
-          password: ${{ secrets.GITHUB_TOKEN }}
+          # The automatic per-job token comes back unauthorized for package
+          # writes on this instance, so use a PAT (scope: write:package) instead.
+          username: ${{ secrets.GITEA_USERNAME }}
+          password: ${{ secrets.GITEA_TOKEN }}
 
       - name: Log in to GHCR
         uses: docker/login-action@v3