diff --git a/.forgejo/workflows/build-push.yml b/.forgejo/workflows/build-push.yml
index 7a81ba5..fa2d1b8 100644
--- a/.forgejo/workflows/build-push.yml
+++ b/.forgejo/workflows/build-push.yml
@@ -49,6 +49,7 @@ jobs:
 
     env:
       REGISTRY: https://${{ vars.REGISTRY_HOST }}
+      REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
 
     steps:
       - uses: actions/checkout@v4
@@ -110,8 +111,6 @@ jobs:
 
       - name: Log in to the Forgejo registry
         if: steps.image.outputs.changed == 'true'
-        env:
-          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
           # NOT secrets.GITHUB_TOKEN -- Forgejo's per-job auto-injected token can
           # never push to the container registry (a known Forgejo limitation,