diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index c4b4105..abb87dd 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -42,7 +42,7 @@ jobs:
       - uses: docker/login-action@v3
         with:
           registry: git.rambossek.at
-          username: ${{ secrets.REGISTRY_USERNAME }}
+          username: ${{ gitea.actor }}
           password: ${{ secrets.REGISTRY_TOKEN }}
 
       - uses: docker/build-push-action@v6
diff --git a/README.md b/README.md
index b831cb2..91edad5 100644
--- a/README.md
+++ b/README.md
@@ -73,9 +73,9 @@ runs `go vet` and `go test -race`, and pushing a semantic-version tag
 `git.rambossek.at/<owner>/gpu-turnstile:vX.Y.Z` (and updates `:latest`).
 No images are built from branches.
 
-The registry login needs two repository secrets (Settings → Actions →
-Secrets): `REGISTRY_USERNAME` and `REGISTRY_TOKEN` — an access token with
-`write:package` scope. The automatic `GITEA_TOKEN` cannot push packages.
+The registry login needs one repository secret (Settings → Actions →
+Secrets): `REGISTRY_TOKEN` — an access token with `write:package` scope.
+The automatic `GITEA_TOKEN` cannot push packages.
 
 ## Development
 
diff --git a/SPEC.md b/SPEC.md
index 0aed913..5a3e905 100644
--- a/SPEC.md
+++ b/SPEC.md
@@ -186,9 +186,9 @@ are new.
   2. on a version tag only (`vX.Y.Z`, enforced): build the image with buildx
      and push it to the Gitea registry
      `git.rambossek.at/<owner>/gpu-turnstile` tagged `:<tag>` and `:latest`.
-     Login uses the repo secrets `REGISTRY_USERNAME` / `REGISTRY_TOKEN` (an
-     access token with `write:package` scope) because the automatic
-     `GITEA_TOKEN` cannot push packages.
+     Login uses the repo secret `REGISTRY_TOKEN` (an access token with
+     `write:package` scope) because the automatic `GITEA_TOKEN` cannot push
+     packages; the username is just `gitea.actor`.
 - Release: a git tag `vX.Y.Z` produces the versioned image; the Open WebUI
   compose pins that tag. No images are built from branches.