diff --git a/.gitea/workflows/coder-templates.yml b/.gitea/workflows/coder-templates.yml
index 2c57b3d..fa55b89 100644
--- a/.gitea/workflows/coder-templates.yml
+++ b/.gitea/workflows/coder-templates.yml
@@ -10,15 +10,18 @@ name: Provision Coder Templates
 #     orphan running workspaces - it just fails loudly and needs a human.
 #
 # Requires two repo/org secrets (Settings > Actions > Secrets):
-#   CODER_URL             e.g. https://code.octoturge.com
-#   CODER_SESSION_TOKEN   a token from `coder tokens create`, ideally under a
+#   CODER_URL              e.g. https://code.octoturge.com
+#   CODER_SESSION_TOKEN    a token from `coder tokens create`, ideally under a
 #                          dedicated service account rather than a personal one
-#   GITEA_PACKAGE_TOKEN   a Gitea access token (user Settings > Applications)
+#   PACKAGE_REGISTRY_TOKEN a Gitea access token (user Settings > Applications)
 #                          with write:package scope, for pushing each
 #                          Dockerfile-having template's image to this
 #                          instance's container registry. Only the octoturge
 #                          account's own token is used - docker login below
-#                          hardcodes that username to match.
+#                          hardcodes that username to match. Named without a
+#                          GITEA_ prefix because Gitea Actions reserves that
+#                          prefix for its own built-in secrets and rejects
+#                          creating one with that name.
 #
 # Any templates/<env>/ that has its own Dockerfile gets its image built and
 # pushed here (build-images, on the dedicated "docker-build" runner - see
@@ -74,7 +77,11 @@ jobs:
         id: build
         run: |
           set -e
-          echo "${{ secrets.GITEA_PACKAGE_TOKEN }}" | docker login git.octoturge.com -u octoturge --password-stdin
+          if [ -z "${{ secrets.PACKAGE_REGISTRY_TOKEN }}" ]; then
+            echo "::error::PACKAGE_REGISTRY_TOKEN secret is empty or unset (Settings > Actions > Secrets on this repo) - can't log in to the registry."
+            exit 1
+          fi
+          echo "${{ secrets.PACKAGE_REGISTRY_TOKEN }}" | docker login git.octoturge.com -u octoturge --password-stdin
 
           FAILED=""
           for dockerfile in templates/*/Dockerfile; do