diff --git a/.gitea/workflows/image.yaml b/.gitea/workflows/image.yaml
index f60623b..69fd725 100644
--- a/.gitea/workflows/image.yaml
+++ b/.gitea/workflows/image.yaml
@@ -34,6 +34,6 @@ jobs:
       - uses: actions/checkout@v4
       - name: Publish image
         env:
-          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME || github.actor }}
           REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: bash scripts/publish_image.sh
diff --git a/README.md b/README.md
index 0c74c72..8683c42 100644
--- a/README.md
+++ b/README.md
@@ -118,9 +118,10 @@ these checks when Compose is not running. Recoll commands run only inside the co
 
 Enable repository Actions and use a runner with the `ubuntu-latest` label, Python 3, `uv` setup support,
 and a working Docker CLI/daemon. Run jobs in isolated containers so a later job cannot read another
-job's home directory. In the repository's Actions secrets, set `REGISTRY_USERNAME` to the
-Gitea account that owns the publishing token and `REGISTRY_TOKEN` to a personal access token with
-package **Read & Write** permission. Gitea currently [requires a PAT for Actions package
+job's home directory. Set the repository Actions secret `REGISTRY_TOKEN` to a personal access token
+with package **Read & Write** permission. The workflow uses the triggering Gitea account as the
+registry username by default. If the token belongs to a different account, set `REGISTRY_USERNAME`
+to that account in repository Actions secrets. Gitea currently [requires a PAT for Actions package
 publishing](https://docs.gitea.com/usage/actions/comparison/); the built-in job token does not publish
 OCI packages. The workflow checks pull requests without registry credentials and publishes only after
 checks pass on `main` or a full `vX.Y.Z` tag. No server deployment is performed by CI.
diff --git a/docs/DECISIONS.md b/docs/DECISIONS.md
index dbea777..4dbec67 100644
--- a/docs/DECISIONS.md
+++ b/docs/DECISIONS.md
@@ -3,6 +3,19 @@
 Append-only, newest first. Never edit or delete an entry — supersede it with a new one that links back.
 One entry per decision a future maintainer would otherwise have to reverse-engineer.
 
+## 2026-09-28 — Default registry login to the triggering Gitea account
+**Status:** accepted
+**Context:** The first publish run received `REGISTRY_TOKEN` but no `REGISTRY_USERNAME`, so Docker
+login stopped with `username is empty`. A working Gitea workflow uses `gitea.actor` for that login.
+**Decision:** default the registry username to Gitea's GitHub-compatible `github.actor` context; an
+explicit `REGISTRY_USERNAME` secret overrides it when the token belongs to another account.
+**Alternatives:** require a second secret for the common case (caused the first-run failure); always
+use the repository owner (wrong for a token owned by a collaborating account).
+**Consequences:** one package-write PAT is enough when its owner triggers the push. Other token owners
+must supply the optional username secret.
+
+---
+
 ## 2026-09-28 — Isolate registry credentials and tag the built image ID
 **Status:** accepted
 **Context:** A persistent Gitea runner can retain Docker login credentials, and jobs sharing a Docker