diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index 154da56..fdf0602 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -3,9 +3,7 @@
 # unknowns with no host-deploy setup. Copy to .forgejo/workflows/build.yml in a
 # throwaway Forgejo repo. Requires:
 #   - repo Variable: FORGEJO_REGISTRY (e.g. forge.currentbits.net)
-#   - repo Secrets:  COSIGN_PRIVATE_KEY, COSIGN_PASSWORD, COSIGN_PUBLIC_KEY,
-#                    REGISTRY_TOKEN (a Forgejo PAT with write:package — the
-#                    automatic Actions token lacks package-write scope)
+#   - repo Secrets:  COSIGN_PRIVATE_KEY, COSIGN_PASSWORD, COSIGN_PUBLIC_KEY
 name: spike-build
 on: [push, workflow_dispatch]
 permissions:
@@ -23,8 +21,7 @@ jobs:
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
-          # Forgejo's automatic token can't push packages — use a PAT (write:package).
-          password: ${{ secrets.REGISTRY_TOKEN }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - id: push
         uses: docker/build-push-action@v6
         with: