diff --git a/.gitea/workflows/release.yaml b/.gitea/workflows/release.yaml
index 71f9597..1de4b1d 100644
--- a/.gitea/workflows/release.yaml
+++ b/.gitea/workflows/release.yaml
@@ -180,9 +180,6 @@ jobs:
     name: Build Docker image artifact
     needs: [validate-tag, test]
     runs-on: ubuntu-latest
-    permissions:
-      code: read
-      packages: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -200,24 +197,6 @@ jobs:
           echo "registry_host=${host}" >> "${GITHUB_OUTPUT}"
           echo "image=${host}/${repo}" >> "${GITHUB_OUTPUT}"
 
-      - name: Login to registry
-        env:
-          REGISTRY_HOST: ${{ steps.image.outputs.registry_host }}
-          REGISTRY_USER: ${{ secrets.REGISTRY_USERNAME }}
-          REGISTRY_PASS: ${{ secrets.REGISTRY_PASSWORD }}
-          FALLBACK_USER: ${{ gitea.actor }}
-          FALLBACK_PASS: ${{ gitea.token }}
-        shell: bash
-        run: |
-          set -eu
-          user="${REGISTRY_USER:-${FALLBACK_USER}}"
-          pass="${REGISTRY_PASS:-${FALLBACK_PASS}}"
-          if [ -z "${pass}" ]; then
-            echo "No registry password available. Set REGISTRY_PASSWORD secret."
-            exit 1
-          fi
-          printf '%s' "${pass}" | docker login "${REGISTRY_HOST}" --username "${user}" --password-stdin
-
       - name: Build image
         env:
           IMAGE: ${{ steps.image.outputs.image }}
@@ -280,7 +259,7 @@ jobs:
           REGISTRY_USER: ${{ secrets.REGISTRY_USERNAME }}
           REGISTRY_PASS: ${{ secrets.REGISTRY_PASSWORD }}
           FALLBACK_USER: ${{ gitea.actor }}
-          FALLBACK_PASS: ${{ gitea.token }}
+          FALLBACK_PASS: ${{ secrets.GITEA_TOKEN }}
         shell: bash
         run: |
           set -eu