diff --git a/.gitea/workflows/docker.yml b/.gitea/workflows/docker.yml
index 7ce4fe2..6d6f842 100644
--- a/.gitea/workflows/docker.yml
+++ b/.gitea/workflows/docker.yml
@@ -20,7 +20,7 @@ jobs:
       - name: Log in to Gitea Container Registry
         env:
           REGISTRY_USERNAME: ${{ gitea.actor }}
-          REGISTRY_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
           printf '%s' "$REGISTRY_TOKEN" |
             docker login git.anchorhost.eu --username "$REGISTRY_USERNAME" --password-stdin
diff --git a/README.md b/README.md
index e0dbd66..732f560 100644
--- a/README.md
+++ b/README.md
@@ -17,6 +17,6 @@ Edit the root `branding.json` to set the product name, domain, logo path, public
 
 ## Gitea Actions Docker publishing
 
-`.gitea/workflows/docker.yml` builds the Docker image when `main` is updated and can also be started manually from the Actions page. It publishes `git.anchorhost.eu/anchorhost.eu/anchorhost-frontend:frontend` and a commit-specific `main-<12 character SHA>` tag to the Gitea Container Registry. The workflow logs in with Gitea's per-job `GITEA_TOKEN`, granted `contents: read` and `packages: write`; no registry password secret is needed.
+`.gitea/workflows/docker.yml` builds the Docker image when `main` is updated and can also be started manually from the Actions page. It publishes `git.anchorhost.eu/anchorhost.eu/anchorhost-frontend:frontend` and a commit-specific `main-<12 character SHA>` tag to the Gitea Container Registry. Add a repository Actions secret named `REGISTRY_TOKEN` containing a Gitea personal access token with package read/write permission. The workflow uses the triggering Gitea username to authenticate.
 
 Enable Actions for the repository and ensure a runner with the Docker CLI and a working Docker daemon is registered. `.dockerignore` keeps local dependencies, Git history, build output, and recovered production artifacts out of the build context.