diff --git a/.gitea/workflows/build-and-deploy.yml b/.gitea/workflows/build-and-deploy.yml
index d16e30e..08bacbf 100644
--- a/.gitea/workflows/build-and-deploy.yml
+++ b/.gitea/workflows/build-and-deploy.yml
@@ -5,10 +5,6 @@ on:
     branches:
       - main
 
-permissions:
-  contents: read
-  packages: write
-
 jobs:
   build:
     runs-on: build-host
@@ -19,11 +15,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Log in to Gitea registry
+      - name: Configure Gitea registry auth
         run: |
-          echo "${{ secrets.GITEA_TOKEN }}" | docker login gitea.dsrptlab.com \
-            -u "${{ github.actor }}" \
-            --password-stdin
+          set -euo pipefail
+          mkdir -p ~/.docker
+          auth="$(printf '%s:%s' "${{ secrets.REGISTRY_USERNAME }}" "${{ secrets.REGISTRY_TOKEN }}" | base64 | tr -d '\n')"
+          printf '{"auths":{"gitea.dsrptlab.com":{"auth":"%s"}}}\n' "$auth" > ~/.docker/config.json
 
       - name: Build and push image
         run: |
@@ -51,7 +48,7 @@ jobs:
           set -euo pipefail
           [ -f .deploy-current ] || exit 0
           payload=$(cat <<JSON
-          {"applicationId":"$DOKPLOY_APPLICATION_ID","dockerImage":"$IMAGE","username":"${{ github.actor }}","password":"${{ secrets.GITEA_TOKEN }}","registryUrl":"gitea.dsrptlab.com"}
+          {"applicationId":"$DOKPLOY_APPLICATION_ID","dockerImage":"$IMAGE","username":"${{ secrets.REGISTRY_USERNAME }}","password":"${{ secrets.REGISTRY_TOKEN }}","registryUrl":"gitea.dsrptlab.com"}
           JSON
           )
           curl -fsS -X POST "${{ secrets.DOKPLOY_URL }}/api/application.saveDockerProvider" \