diff --git a/.gitea/workflows/build-and-publish.yml b/.gitea/workflows/build-and-publish.yml
index 0074a95..8ec4cbe 100644
--- a/.gitea/workflows/build-and-publish.yml
+++ b/.gitea/workflows/build-and-publish.yml
@@ -19,16 +19,15 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      # GITEA_TOKEN is the automatic Actions token. If your instance rejects it
-      # for registry auth, create a personal access token with package
-      # read/write scope, save it as a repo secret (e.g. REGISTRY_TOKEN),
-      # and use that here instead.
+      # ACTION_TOKEN is a personal access token with package read/write scope,
+      # stored as a runner secret (the automatic GITEA_TOKEN doesn't work for
+      # registry auth on this instance).
       - name: Log in to Gitea container registry
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITEA_TOKEN }}
+          password: ${{ secrets.ACTION_TOKEN }}
 
       - name: Extract image metadata
         id: meta
@@ -56,7 +55,7 @@ jobs:
       - name: Link package to repository
         run: |
           curl -sf -X POST \
-            -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+            -H "Authorization: token ${{ secrets.ACTION_TOKEN }}" \
             "${{ github.server_url }}/api/v1/packages/${{ github.repository_owner }}/container/${{ github.event.repository.name }}/-/link/${{ github.event.repository.name }}" \
             && echo "Package linked to repository" \
             || echo "Link skipped (already linked, or token lacks permission)"