diff --git a/.gitea/workflows/ci-image.yml b/.gitea/workflows/ci-image.yml
index 05a82cb..8d2aa42 100644
--- a/.gitea/workflows/ci-image.yml
+++ b/.gitea/workflows/ci-image.yml
@@ -10,10 +10,6 @@ on:
     - cron: '0 3 * * 1'
   workflow_dispatch:
 
-permissions:
-  contents: read
-  packages: write
-
 jobs:
   image:
     # The build runs on the runner's own Docker daemon, so the amd64 runner has the new
@@ -26,6 +22,10 @@ jobs:
       - name: Build
         run: docker build --pull -t "$IMAGE" .gitea/ci-image
       - name: Push
+        # Gitea's Actions token cannot push to the container registry, so this uses an
+        # access token with the write:package scope.
+        env:
+          TOKEN: ${{ secrets.PACKAGES_TOKEN }}
         run: |
-          echo "${{ secrets.GITHUB_TOKEN }}" | docker login git.trivk.dev -u "${{ github.actor }}" --password-stdin
+          echo "$TOKEN" | docker login git.trivk.dev -u "${{ github.repository_owner }}" --password-stdin
           docker push "$IMAGE"