diff --git a/.gitea/README.md b/.gitea/README.md
index 18b369b..fbae199 100644
--- a/.gitea/README.md
+++ b/.gitea/README.md
@@ -182,11 +182,14 @@ The workflow finally commits that image's immutable OCI digest to
 Argo CD notices that commit and performs the rollout; the workflow does not
 hold Kubernetes credentials or change the cluster directly.
 
-The Gitea Actions repository secret `GITEATOKEN` must belong to `ci-bot`
-and be able to:
+The publishing workflow uses two Gitea Actions repository secrets belonging
+to `ci-bot`:
 
-- push packages owned by the `ahmza.com` organization
-- read and write `ahmza.com/k8s-starter-pack`
+- `REGISTRY_TOKEN` can push packages owned by the `ahmza.com` organization
+- `GITOPS_TOKEN` can read and write `ahmza.com/k8s-starter-pack`
+
+Keeping these credentials separate ensures that the package token cannot modify
+Git repositories and the GitOps token cannot publish packages.
 
 The `latest` image tag exists only to bootstrap the first Argo CD sync and for
 human inspection. Normal rollouts use the exact content digest recorded in the
diff --git a/.gitea/workflows/publish.yml b/.gitea/workflows/publish.yml
index 3c57c5a..11a6514 100644
--- a/.gitea/workflows/publish.yml
+++ b/.gitea/workflows/publish.yml
@@ -67,7 +67,7 @@ jobs:
         with:
           registry: ${{ env.REGISTRY }}
           username: ci-bot
-          password: ${{ secrets.GITEATOKEN }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       # The SWS runtime image already publishes amd64 and arm64 variants and
       # this Dockerfile has no target-architecture RUN commands, so Buildx can
@@ -96,7 +96,7 @@ jobs:
         with:
           repository: ahmza.com/k8s-starter-pack
           ref: main
-          token: ${{ secrets.GITEATOKEN }}
+          token: ${{ secrets.GITOPS_TOKEN }}
           path: _gitops
 
       - name: Record the deployed image in Git