diff --git a/.gitea/workflows/build-and-deploy.yml b/.gitea/workflows/build-and-deploy.yml
index dce860a..d16e30e 100644
--- a/.gitea/workflows/build-and-deploy.yml
+++ b/.gitea/workflows/build-and-deploy.yml
@@ -5,6 +5,10 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   build:
     runs-on: build-host
@@ -17,8 +21,8 @@ jobs:
 
       - name: Log in to Gitea registry
         run: |
-          echo "${{ secrets.REGISTRY_TOKEN }}" | docker login gitea.dsrptlab.com \
-            -u "${{ secrets.REGISTRY_USERNAME }}" \
+          echo "${{ secrets.GITEA_TOKEN }}" | docker login gitea.dsrptlab.com \
+            -u "${{ github.actor }}" \
             --password-stdin
 
       - name: Build and push image
@@ -47,7 +51,7 @@ jobs:
           set -euo pipefail
           [ -f .deploy-current ] || exit 0
           payload=$(cat <<JSON
-          {"applicationId":"$DOKPLOY_APPLICATION_ID","dockerImage":"$IMAGE","username":"${{ secrets.REGISTRY_USERNAME }}","password":"${{ secrets.REGISTRY_TOKEN }}","registryUrl":"gitea.dsrptlab.com"}
+          {"applicationId":"$DOKPLOY_APPLICATION_ID","dockerImage":"$IMAGE","username":"${{ github.actor }}","password":"${{ secrets.GITEA_TOKEN }}","registryUrl":"gitea.dsrptlab.com"}
           JSON
           )
           curl -fsS -X POST "${{ secrets.DOKPLOY_URL }}/api/application.saveDockerProvider" \