diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index f6b5a26..40586d1 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -25,6 +25,12 @@ jobs:
     # sibling repos use for their image jobs.
     runs-on: ubuntu-host
 
+    # Grant the auto-injected Actions token the scopes this job needs: push to
+    # the built-in container registry (packages) and create a release (contents).
+    permissions:
+      contents: write
+      packages: write
+
     env:
       # Optional EXTERNAL registry override. Leave these unset to publish to the
       # Gitea instance's own built-in container registry (the default below).
@@ -32,8 +38,9 @@ jobs:
       REGISTRY_USER: ${{ secrets.REGISTRY_USERNAME }}
       REGISTRY_PASS: ${{ secrets.REGISTRY_PASSWORD }}
       # Injected automatically by Gitea Actions; used for the built-in registry
-      # login and for creating the release. No manual secret needed.
-      BUILTIN_TOKEN: ${{ secrets.GITEA_TOKEN }}
+      # login and for creating the release. github.token is always populated
+      # (unlike secrets.GITEA_TOKEN, which is not defined on every instance).
+      BUILTIN_TOKEN: ${{ github.token }}
       SERVER_URL: ${{ github.server_url }}
       ACTOR: ${{ github.actor }}
       OWNER: ${{ github.repository_owner }}
@@ -167,7 +174,7 @@ jobs:
         env:
           API_URL: ${{ github.api_url }}
           REPO: ${{ github.repository }}
-          TOKEN: ${{ secrets.GITEA_TOKEN }}
+          TOKEN: ${{ github.token }}
           VERSION: ${{ steps.ver.outputs.version }}
           GIT_COMMIT: ${{ steps.ver.outputs.git_commit }}
           GIT_COMMIT_SHORT: ${{ steps.ver.outputs.git_commit_short }}