diff --git a/.gitea/workflows/promote.yml b/.gitea/workflows/promote.yml
index 703c4ff..777530c 100644
--- a/.gitea/workflows/promote.yml
+++ b/.gitea/workflows/promote.yml
@@ -67,9 +67,12 @@ jobs:
           echo "Promoting $FULL_SHA (images tagged $SHORT_SHA)"
 
       - name: Verify the staging E2E gate passed for this commit
+        # Use the built-in Actions token (GITHUB_TOKEN is the documented name;
+        # it carries repository read scope), NOT REGISTRY_TOKEN — the registry
+        # token has no repo scope, so the commit-status API returns 403.
         run: |
           STATUS_JSON=$(curl -fsS \
-            -H "Authorization: token ${{ secrets.REGISTRY_TOKEN }}" \
+            -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
             "https://${REGISTRY}/api/v1/repos/${{ gitea.repository }}/commits/${{ steps.resolve.outputs.full }}/status")
           echo "$STATUS_JSON" | python3 -c "
           import json, sys