diff --git a/.gitea/workflows/nightly.yml b/.gitea/workflows/nightly.yml
index 41ea65f..41f009f 100644
--- a/.gitea/workflows/nightly.yml
+++ b/.gitea/workflows/nightly.yml
@@ -14,11 +14,8 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
-    # Grant the auto-provisioned github.token write access to the package
-    # registry (otherwise uploads get HTTP 401 reqPackageAccess).
     permissions:
       contents: read
-      packages: write
     container:
       image: archlinux:latest
       # makepkg refuses to run as root; we create a build user below.
@@ -35,7 +32,6 @@ jobs:
         pkg:
           - bacula
           - fchat-horizon-appimage
-          - ggml-git-latest-commit
           - openrgb-git
           - paru
           - plezy-bin
@@ -66,7 +62,7 @@ jobs:
           AUTOPKG_OWNER: ${{ github.repository_owner }}
           AUTOPKG_REPO: arch
           AUTOPKG_USER: ${{ github.actor }}
-          AUTOPKG_TOKEN: ${{ secrets.PACKAGE_TOKEN || github.token }}
+          AUTOPKG_TOKEN: ${{ secrets.PACKAGE_TOKEN }}
           AUTOPKG_REPLACE: ${{ github.event.inputs.replace }}
           AUTOPKG_SKIP_PGP: "1" # Womp womp
           PKG: ${{ matrix.pkg }}
diff --git a/autopackage.py b/autopackage.py
index 34f62de..cdcb6ee 100644
--- a/autopackage.py
+++ b/autopackage.py
@@ -318,6 +318,17 @@ def publish_file(path: Path, cfg: Config) -> None:
         print(f"  {path.name} already published (409); skipping "
               f"(use --replace to overwrite)")
         return
+    if status in (401, 403):
+        raise RuntimeError(
+            f"upload of {path.name} failed: HTTP {status}: "
+            f"{body.strip()[:200]}\n"
+            f"  -> The registry rejected the credentials for owner "
+            f"'{cfg.owner}'.\n"
+            f"     Gitea's automatic Actions token (github.token / "
+            f"GITEA_TOKEN) cannot write packages.\n"
+            f"     Use a Personal Access Token with the 'write:package' scope "
+            f"(set PACKAGE_TOKEN / --token)."
+        )
     raise RuntimeError(
         f"upload of {path.name} failed: HTTP {status}: {body.strip()[:500]}"
     )