diff --git a/.gitea/workflows/images.yml b/.gitea/workflows/images.yml
index d1d6051..0af023a 100644
--- a/.gitea/workflows/images.yml
+++ b/.gitea/workflows/images.yml
@@ -1,8 +1,8 @@
 # Builds the app, session manager and streamer images and pushes them to this
 # Gitea instance's container registry, under the repository's owner.
 #
-# Needs repository secrets REGISTRY_USERNAME and REGISTRY_TOKEN: a user, and an
-# access token of theirs with package write access.
+# Needs a repository secret REGISTRY_TOKEN: an access token with package write
+# access, belonging to the repository's owner.
 name: Images
 
 on:
@@ -46,7 +46,7 @@ jobs:
       - uses: docker/login-action@v3
         with:
           registry: ${{ steps.registry.outputs.host }}
-          username: ${{ secrets.REGISTRY_USERNAME }}
+          username: ${{ github.repository_owner }}
           password: ${{ secrets.REGISTRY_TOKEN }}
 
       - id: meta
diff --git a/docs/09-deployment/docker-deployment.md b/docs/09-deployment/docker-deployment.md
index d4760fe..d3a0f72 100644
--- a/docs/09-deployment/docker-deployment.md
+++ b/docs/09-deployment/docker-deployment.md
@@ -45,10 +45,9 @@ pushes them to the Gitea instance's container registry, under the repository's
 owner. Pushes to `main` publish a `main` tag; `v1.2.3` tags publish `1.2.3`,
 `1.2` and `latest`. Its jobs run docker builds, so they need a runner labelled
 `dejima-privileged`; jobs that don't build images should use `dejima-confined`.
-It also needs two repository secrets:
-
-- `REGISTRY_USERNAME`: a user;
-- `REGISTRY_TOKEN`: an access token of theirs with package write access.
+It also needs a repository secret, `REGISTRY_TOKEN`: an access token with
+package write access, belonging to the repository's owner, whom the workflow
+logs in as.
 
 ## Volumes