diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index fc496d9..a2dae27 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -335,9 +335,11 @@ jobs:
       # GITEA_TOKEN/GITHUB_TOKEN cannot push packages; a PAT with write:package scope is required
       # (confirmed: Gitea forum + registry docs). Token is masked by Gitea's secret-log scrubber
       # and never echoed elsewhere or set as a plain env var.
+      # Secret is named REGISTRY_PAT (not GITEA_REGISTRY_PAT): Gitea reserves the GITEA_ prefix
+      # for secret names, so the GITEA_-prefixed name cannot be created.
       - name: Docker login
         run: |
-          echo "${{ secrets.GITEA_REGISTRY_PAT }}" | \
+          echo "${{ secrets.REGISTRY_PAT }}" | \
           docker login git.bergerhouse.net \
             --username luckberg \
             --password-stdin