diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index d9bf492..561b71b 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -56,9 +56,14 @@ jobs:
       - name: Login to Forgejo registry
         run: |
           set -euo pipefail
-          # Forgejo Actions token can push packages when packages:write is granted
-          echo "${{ secrets.GITHUB_TOKEN }}" | docker login "${{ steps.img.outputs.reg }}" \
-            -u "${{ github.actor }}" --password-stdin
+          # GITHUB_TOKEN login "succeeds" but blob uploads 401 (Forgejo packages
+          # reject the Actions token). Use a user PAT with write:package.
+          if [ -z "${{ secrets.FORGEJO_TOKEN }}" ]; then
+            echo "Missing repo secret FORGEJO_TOKEN (user PAT, not GITHUB_TOKEN)"
+            exit 1
+          fi
+          echo "${{ secrets.FORGEJO_TOKEN }}" | docker login "${{ steps.img.outputs.reg }}" \
+            -u sirius --password-stdin
 
       - name: Build application image (api / ingester / cameras)
         run: |