diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 29dd278a..79e18830 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -183,6 +183,9 @@ jobs:
       # last upstream-parity publish.
       - name: Publish
         working-directory: embedded/web
+        # Secret names starting with GITEA_ are reserved and can't be created, so
+        # the original `GITEA_NPM_TOKEN` never existed (every CI publish since the
+        # fork's first commit hit ENEEDAUTH). Org secret, write:package scope.
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
         run: npm publish --access public --tag lotus