diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 7b291f8..cbf0412 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -10,18 +10,18 @@ name: Build
 # This project's CI/CD scope is intentionally just test/build/push --
 # deployment is being split into a separate project.
 #
-# Requires secrets.CONTAINER_REGISTRY_PASSWORD -- a personal access token
-# (write:package scope) from the pushing account, stored manually as a repo
-# secret. The auto-injected secrets.GITEA_TOKEN does NOT work for this: it
-# never grants package-registry access regardless of the workflow's own
-# `permissions:` block -- a known Gitea limitation, not a config mistake
-# (https://github.com/go-gitea/gitea/issues/23642).
+# Requires secrets.GITEA_TOKEN (auto-injected by Gitea Actions; needs the
+# "packages" permission scope to push images).
 
 on:
   push:
     branches: [main]
   workflow_dispatch:
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
@@ -42,8 +42,8 @@ jobs:
 
       - name: Log in to the container registry
         env:
-          CONTAINER_REGISTRY_PASSWORD: ${{ secrets.CONTAINER_REGISTRY_PASSWORD }}
-        run: echo "$CONTAINER_REGISTRY_PASSWORD" | docker login code.aneur.in -u "${{ gitea.actor }}" --password-stdin
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: echo "$GITEA_TOKEN" | docker login code.aneur.in -u "${{ gitea.actor }}" --password-stdin
 
       - name: Promote the current "latest" to "previous"
         run: |
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 90dad22..5e32314 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -10,17 +10,17 @@ name: Release
 # Assumes tags are cut from commits already on main (and so already covered
 # by ci.yml's checks) -- this workflow doesn't run the test suite itself.
 #
-# Requires secrets.CONTAINER_REGISTRY_PASSWORD -- a personal access token
-# (write:package scope) from the pushing account, stored manually as a repo
-# secret. The auto-injected secrets.GITEA_TOKEN does NOT work for this: it
-# never grants package-registry access regardless of the workflow's own
-# `permissions:` block -- a known Gitea limitation, not a config mistake
-# (https://github.com/go-gitea/gitea/issues/23642).
+# Requires secrets.GITEA_TOKEN (auto-injected; needs the "packages"
+# permission scope to push images).
 
 on:
   push:
     tags: ['*']
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
@@ -40,8 +40,8 @@ jobs:
 
       - name: Log in to the container registry
         env:
-          CONTAINER_REGISTRY_PASSWORD: ${{ secrets.CONTAINER_REGISTRY_PASSWORD }}
-        run: echo "$CONTAINER_REGISTRY_PASSWORD" | docker login code.aneur.in -u "${{ gitea.actor }}" --password-stdin
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: echo "$GITEA_TOKEN" | docker login code.aneur.in -u "${{ gitea.actor }}" --password-stdin
 
       - name: Build and push the image
         run: |