diff --git a/.gitea/workflows/images.yml b/.gitea/workflows/images.yml
index b3fc155d..d72fe110 100644
--- a/.gitea/workflows/images.yml
+++ b/.gitea/workflows/images.yml
@@ -15,9 +15,10 @@ on:
       - "**.md"
   workflow_dispatch:
 
+# The job token can't log in to the registry (no package scope there), so
+# the push uses the reweave-ci bot's token from the org secret REGISTRY_TOKEN.
 permissions:
   contents: read
-  packages: write
 
 jobs:
   images:
@@ -31,7 +32,7 @@ jobs:
           fetch-depth: 0 # tags, for the version string
 
       - name: Log in to the registry
-        run: echo "${{ secrets.GITEA_TOKEN }}" | docker login "$REGISTRY" -u "${{ gitea.actor }}" --password-stdin
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login "$REGISTRY" -u reweave-ci --password-stdin
 
       - name: Build and push (linux/amd64)
         run: |