diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index c2747f8..04b3b67 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -27,6 +27,13 @@ env:
   GITEA_HOST: gitea.coolify.vojtkov.dev
   GITEA_OWNER: usr_unknown
 
+# The token Actions injects can read the package registry but not write to
+# it: a publish comes back 401 under both Bearer and Basic. Ask for one that
+# can.
+permissions:
+  contents: write
+  packages: write
+
 jobs:
   # The plugin binaries. Pulumi resolves them from this release via the
   # PluginDownloadURL baked into the schema, so this has to land before anyone
@@ -171,13 +178,9 @@ jobs:
         env:
           TOKEN: ${{ secrets.GITEA_TOKEN }}
         run: |
-          # `_authToken` makes npm send `Authorization: Bearer`, which this
-          # Gitea refuses for the token Actions injects -- the publish failed
-          # with E401 while the very same token authenticated fine over Basic.
-          # `_auth` is base64 user:token, i.e. Basic.
           cat > .npmrc <<EOF
           @maxvojtkov:registry=https://${GITEA_HOST}/api/packages/${GITEA_OWNER}/npm/
-          //${GITEA_HOST}/api/packages/${GITEA_OWNER}/npm/:_auth=$(printf '%s:%s' "${GITEA_OWNER}" "${TOKEN}" | base64 -w0)
+          //${GITEA_HOST}/api/packages/${GITEA_OWNER}/npm/:_authToken=${TOKEN}
           EOF
           npm publish