diff --git a/.gitea/workflows/publish.yml b/.gitea/workflows/publish.yml
index 001de32..5817349 100644
--- a/.gitea/workflows/publish.yml
+++ b/.gitea/workflows/publish.yml
@@ -59,8 +59,15 @@ jobs:
       # Secret is named REGISTRY_PAT (not GITEA_REGISTRY_PAT): Gitea reserves the GITEA_ prefix
       # for secret names, so the GITEA_-prefixed name cannot be created.
       - name: Docker login
+        # Bind the secret through env: so it is never substituted into the rendered
+        # script body. Read it as $REGISTRY_PAT and pipe with printf '%s' (echo is not
+        # safe for arbitrary strings — a trailing newline or shell-significant char
+        # would mangle the password into a confusing `unauthorized`) (WR-05).
+        env:
+          REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
         run: |
-          echo "${{ secrets.REGISTRY_PAT }}" | \
+          set -euo pipefail
+          printf '%s' "$REGISTRY_PAT" | \
           docker login git.bergerhouse.net \
             --username luckberg \
             --password-stdin