diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 32ca8df..4fb9861 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -42,6 +42,7 @@ jobs:
     needs: [lint, test]
     runs-on: ubuntu-latest
     permissions:
+      contents: read   # needed for checkout of the private repo
       packages: write
     steps:
       - uses: actions/checkout@v4
@@ -70,7 +71,7 @@ jobs:
         env:
           # The auto-provided token works for the same owner's package registry.
           # Override with a PACKAGE_REGISTRY_TOKEN secret if your instance needs it.
-          TWINE_USERNAME: ${{ gitea.actor }}
+          TWINE_USERNAME: ${{ github.actor }}
           TWINE_PASSWORD: ${{ secrets.PACKAGE_REGISTRY_TOKEN || secrets.GITHUB_TOKEN }}
         run: |
           uvx twine upload \