diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index a8afedd..bb2a651 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -69,8 +69,12 @@ jobs:
           - { name: operator, dir: apps/operator }
     steps:
       - uses: actions/checkout@v4
+      # REGISTRY_TOKEN is a Gitea personal access token with package read+write
+      # scope (repo Settings → Actions → Secrets). The per-job GITHUB_TOKEN
+      # stopped being accepted by the registry's /v2/ basic-auth endpoint after
+      # the act_runner → gitea/runner switch, so registry pushes use a PAT.
       - name: Registry login
-        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login git.lastcloud.io -u "${{ github.actor }}" --password-stdin
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.lastcloud.io -u "${{ github.actor }}" --password-stdin
       - name: Build + push
         run: |
           IMG=git.lastcloud.io/ronnibaslund/dezky/${{ matrix.app.name }}