diff --git a/.gitea/workflows/ci-cd.yml b/.gitea/workflows/ci-cd.yml
index 562c44a..6945ba0 100644
--- a/.gitea/workflows/ci-cd.yml
+++ b/.gitea/workflows/ci-cd.yml
@@ -61,14 +61,14 @@ jobs:
       - name: Login to registry
         env:
           REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
-          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
           set -eu
-          if [ -z "${REGISTRY_USERNAME:-}" ] || [ -z "${REGISTRY_PASSWORD:-}" ]; then
-            echo "REGISTRY_USERNAME and REGISTRY_PASSWORD secrets are required."
+          if [ -z "${REGISTRY_USERNAME:-}" ] || [ -z "${REGISTRY_TOKEN:-}" ]; then
+            echo "REGISTRY_USERNAME and REGISTRY_TOKEN secrets are required."
             exit 1
           fi
-          printf '%s' "$REGISTRY_PASSWORD" | docker login "$REGISTRY_URL" --username "$REGISTRY_USERNAME" --password-stdin
+          printf '%s' "$REGISTRY_TOKEN" | docker login "$REGISTRY_URL" --username "$REGISTRY_USERNAME" --password-stdin
 
       - name: Build Docker image
         run: |
diff --git a/deploy/README.md b/deploy/README.md
index 3c238c4..8e2364f 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -50,7 +50,7 @@ The workflow at `.gitea/workflows/ci-cd.yml` expects these repository secrets:
 ```sh
 REGISTRY_URL=gitea.blyzer.com.br
 REGISTRY_USERNAME=...
-REGISTRY_PASSWORD=...
+REGISTRY_TOKEN=...
 IMAGE_REPOSITORY=blyzer/production-order-tiny
 PORTAINER_WEBHOOK_URL=https://... # optional but recommended
 ```