diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 964c02b..e091f8c 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -8,9 +8,10 @@
 # tip (family rule 46) — no version release required. The :<sha> image is the
 # immutable rollback unit for every build.
 #
-# Required secrets (repo -> Settings -> Secrets -> Actions):
-#   REGISTRY_USER   -- Forgejo username
+# Required secret (repo -> Settings -> Secrets -> Actions):
 #   REGISTRY_TOKEN  -- Forgejo PAT with write:packages scope
+# The registry username is derived from github.repository_owner (public — it's in
+# the image path), so no REGISTRY_USER secret is needed.
 name: CI & Build
 
 on:
@@ -142,7 +143,7 @@ jobs:
         uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
-          username: ${{ secrets.REGISTRY_USER }}
+          username: ${{ github.repository_owner }}
           password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Build and push