diff --git a/.gitea/workflows/build-images.yaml b/.gitea/workflows/build-images.yaml
index f4df82a..c4dbb8c 100644
--- a/.gitea/workflows/build-images.yaml
+++ b/.gitea/workflows/build-images.yaml
@@ -46,11 +46,9 @@ jobs:
       - name: Install Git and Docker CLI
         run: apk add --no-cache git docker-cli docker-cli-buildx
       - name: Log in to Gitea Container Registry
-        # The token reaches the shell as an environment variable, never as text inside the script.
-        env:
-          REGISTRY_TOKEN: ${{ secrets.kvitt_cicd }}
-          REGISTRY_USER: ${{ github.actor }}
-        run: printf '%s' "$REGISTRY_TOKEN" | docker login "$REGISTRY_HOST" -u "$REGISTRY_USER" --password-stdin
+        # The owner's proven form: the secret interpolated into the run line (act_runner masks it in the log).
+        # The env-based form (env: REGISTRY_TOKEN: ${{ secrets.kvitt_cicd }}) came through empty on act_runner 0.6.1.
+        run: printf '%s' "${{ secrets.kvitt_cicd }}" | docker login "$REGISTRY_HOST" -u "${{ github.actor }}" --password-stdin
       - name: Create Custom Buildx Builder for HTTP
         run: |
           # Create the builder once and reuse it, so its BuildKit cache (cargo registry, target) survives runs.