diff --git a/.gitea/workflows/docker.yml b/.gitea/workflows/docker.yml
index 3a80c24..e9e8bd4 100644
--- a/.gitea/workflows/docker.yml
+++ b/.gitea/workflows/docker.yml
@@ -25,11 +25,16 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Log in to Gitea container registry
+        # Uses a personal access token (PAT) with write:package scope.
+        # The default GITEA_TOKEN cannot push to the container registry.
+        # Create the PAT under User Settings → Applications, add it as a repo
+        # secret named REGISTRY_TOKEN, and (optionally) REGISTRY_USER if the
+        # owning account differs from ${{ gitea.actor }}.
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
-          username: ${{ gitea.actor }}
-          password: ${{ secrets.GITEA_TOKEN }}
+          username: ${{ secrets.REGISTRY_USER || gitea.actor }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Derive tags
         id: meta