diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 91d0f68..8382282 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -13,9 +13,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-# The auto GITHUB_TOKEN needs `packages: write` to push to the forge's container
-# registry — without it Kaniko's push-permission check 401s (reqPackageAccess).
-# `contents: read` keeps git clone (checkout / Kaniko git context) working.
+# The registry push uses a PAT with `write:package` scope, supplied via the
+# REGISTRY_USER / REGISTRY_TOKEN Actions secrets (same as moby/uberbau_xyz and
+# moby/claude-code). Forgejo's auto GITHUB_TOKEN lacks org package-write, so a
+# push authenticated with it 401s (reqPackageAccess). `contents: read` keeps the
+# Kaniko git-context clone (over the auto token) working; `packages: write` is
+# belt-and-suspenders on the auto token.
 permissions:
   contents: read
   packages: write
@@ -86,11 +89,11 @@ jobs:
     steps:
       - name: Build and push (Kaniko)
         env:
-          # Forgejo auto-provides GITHUB_TOKEN; it can push packages for this
-          # repo's owner (moby) and read this (private-context) git repo.
-          FORGE_USER: ${{ github.actor }}
-          FORGE_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # Kaniko reads these to clone the `--context` git URL.
+          # Registry push uses a PAT with write:package scope (Forgejo's auto
+          # GITHUB_TOKEN lacks org package-write -> 401 reqPackageAccess).
+          FORGE_USER: ${{ secrets.REGISTRY_USER }}
+          FORGE_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+          # Kaniko clones the `--context` git URL over the auto token (read).
           GIT_USERNAME: ${{ github.actor }}
           GIT_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
         run: |