diff --git a/.gitea/workflows/spike-registry.yml b/.gitea/workflows/spike-registry.yml
index c6adb60..d6f48fb 100644
--- a/.gitea/workflows/spike-registry.yml
+++ b/.gitea/workflows/spike-registry.yml
@@ -85,20 +85,26 @@ jobs:
           echo "--- can it reach the daemon through the socket? ---"
           docker info --format 'server {{.ServerVersion}}, {{.Driver}}, {{.Architecture}}'
 
-      # Reported as a boolean, never printed. If this says NO, the login below
-      # will fail and the fix is to add the secret, not to change the workflow.
+      # REGISTRY_TOKEN, not GITEA_TOKEN. Iteration 2 established that the token
+      # Actions injects automatically is scoped for the repository API and is
+      # refused by the package registry — the login failed with a 401, not a
+      # certificate error, so everything except the credential was already
+      # working. This is a personal access token carrying write:package.
+      #
+      # Reported as a boolean and never printed. If this says EMPTY the fix is
+      # the secret, not the workflow.
       - name: Is a token available?
         continue-on-error: true
         run: |
-          if [ -n "${{ secrets.GITEA_TOKEN }}" ]; then
-            echo "GITEA_TOKEN is present"
+          if [ -n "${{ secrets.REGISTRY_TOKEN }}" ]; then
+            echo "REGISTRY_TOKEN is present"
           else
-            echo "GITEA_TOKEN is EMPTY — add a repo secret with package write scope"
+            echo "REGISTRY_TOKEN is EMPTY — add a repo secret holding a PAT with write:package"
           fi
 
       - name: Question 2a — log in to the registry
         run: |
-          echo "${{ secrets.GITEA_TOKEN }}" \
+          echo "${{ secrets.REGISTRY_TOKEN }}" \
             | docker login "$REGISTRY" -u "${{ github.actor }}" --password-stdin
 
       # A trivial image first, deliberately. It separates "can this runner build