diff --git a/.gitea/workflows/coder-templates.yml b/.gitea/workflows/coder-templates.yml
index 29c0a9d..cebe393 100644
--- a/.gitea/workflows/coder-templates.yml
+++ b/.gitea/workflows/coder-templates.yml
@@ -9,23 +9,26 @@ name: Provision Coder Templates
 #     template that still has active workspaces, so this can't silently
 #     orphan running workspaces - it just fails loudly and needs a human.
 #
-# Requires two repo/org secrets (Settings > Actions > Secrets):
-#   CODER_URL             e.g. https://code.octoturge.com
-#   CODER_SESSION_TOKEN   a token from `coder tokens create`, ideally under a
+# Requires three repo/org secrets (Settings > Actions > Secrets):
+#   CODER_URL              e.g. https://code.octoturge.com
+#   CODER_SESSION_TOKEN    a token from `coder tokens create`, ideally under a
 #                          dedicated service account rather than a personal one
+#   PACKAGE_REGISTRY_TOKEN a Gitea access token (user Settings > Applications)
+#                          with write:package scope, for pushing each
+#                          Dockerfile-having template's image to this
+#                          instance's container registry.
 #
-# Pushing each Dockerfile-having template's image to this instance's
-# container registry uses Gitea's own built-in secrets.GITEA_TOKEN (no
-# manually-created PAT needed) - build-images grants it write access via
-# `permissions: packages: write` below. See
-# https://docs.gitea.com/usage/actions/token-permissions/
-#
-# GITEA_TOKEN impersonates whoever authenticated the triggering push
-# (github.actor), not necessarily the repo owner - that account needs
-# write access to this repo's package registry itself, separate from
-# having git push access to the repo. A push authenticated as an account
-# without registry access fails at docker login with a plain
-# "unauthorized" (not a token/config problem).
+# Not secrets.GITEA_TOKEN (Gitea Actions' built-in token): as of this
+# writing it cannot authenticate to the container registry in any shipped
+# Gitea version - `permissions: packages: write` is a no-op because the
+# Actions token's package scope isn't wired up server-side yet (open since
+# Gitea 1.19: https://github.com/go-gitea/gitea/issues/23642; fix in
+# https://github.com/go-gitea/gitea/pull/39070, not yet merged). Every
+# attempt fails at docker login with a plain "unauthorized", regardless of
+# the permissions: block or which account triggered the workflow. A
+# manually-created PAT is the only thing that currently works. Named
+# without a GITEA_ prefix because Gitea Actions reserves that prefix for
+# its own built-in secrets and rejects creating one with that name.
 #
 # Any templates/<env>/ that has its own Dockerfile gets its image built and
 # pushed here (build-images, on the dedicated "docker-build" runner - see
@@ -56,11 +59,6 @@ jobs:
     # container.volumes mount for the same path here fails at container
     # creation with "Duplicate mount point: /var/run/docker.sock".
     runs-on: docker-build
-    # The default token permission mode denies package write unless a job
-    # explicitly asks for it - without this, docker push fails with
-    # "unauthorized: reqPackageAccess".
-    permissions:
-      packages: write
     outputs:
       failed_templates: ${{ steps.build.outputs.failed_templates }}
     # docker:27-cli (Alpine) has no bash - only the POSIX /bin/sh (busybox
@@ -86,7 +84,7 @@ jobs:
         id: build
         run: |
           set -e
-          echo "${{ secrets.GITEA_TOKEN }}" | docker login git.octoturge.com -u "${{ github.actor }}" --password-stdin
+          echo "${{ secrets.PACKAGE_REGISTRY_TOKEN }}" | docker login git.octoturge.com -u octoturge --password-stdin
 
           FAILED=""
           for dockerfile in templates/*/Dockerfile; do