diff --git a/.forgejo/workflows/build-push.yml b/.forgejo/workflows/build-push.yml
index 7a81ba5..dd152ec 100644
--- a/.forgejo/workflows/build-push.yml
+++ b/.forgejo/workflows/build-push.yml
@@ -151,8 +151,16 @@ jobs:
           esac
           [ "${#tok}" -eq 40 ] || echo "::warning::REGISTRY_TOKEN is ${#tok} characters," \
             "expected 40. If the login below fails, re-paste the secret."
-          printf '%s' "$tok" | docker login "${{ steps.image.outputs.host }}" \
-            --username admin_emi --password-stdin
+          echo "DIAG: host=${{ steps.image.outputs.host }} changed=${{ steps.image.outputs.changed }}"
+          echo "DIAG: token length=${#tok}"
+          echo "DIAG: attempting docker login as admin_emi"
+          if printf '%s' "$tok" | docker login "${{ steps.image.outputs.host }}" \
+               --username admin_emi --password-stdin; then
+            echo "DIAG: docker login EXIT 0"
+          else
+            echo "DIAG: docker login EXIT $? (non-zero)"
+          fi
+          echo "DIAG: config.json auths:"; jq -r '.auths | keys[]?' /root/.docker/config.json 2>/dev/null || echo "DIAG: no config.json"
 
       - name: Build
         if: steps.image.outputs.changed == 'true'