diff --git a/.changeset/README.md b/.changeset/README.md
index 8fb37ba..4ad29b2 100644
--- a/.changeset/README.md
+++ b/.changeset/README.md
@@ -35,4 +35,5 @@ Bundles are built from `package.json#version`, so the registry upload uses the n
 
 CI verifies (format, lint, schema check, tests) and builds bundles on every push/PR. On `main`
 the `publish` job uploads the bundles to the Gitea generic package registry using the
-`GITEA_TOKEN` repository secret (requires `write:package` scope).
\ No newline at end of file
+`DEPLOY_TOKEN` repository secret (requires `write:package` scope). Secret names cannot start
+with the reserved `GITEA_` prefix.
\ No newline at end of file
diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index f7d936b..e2befdf 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -55,5 +55,5 @@ jobs:
         env:
           GITEA_URL: https://gitea.devegamoreno.com
           GITEA_OWNER: jdevega
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
         run: ./scripts/publish.sh
\ No newline at end of file
diff --git a/Makefile b/Makefile
index ff39cfa..896628b 100644
--- a/Makefile
+++ b/Makefile
@@ -12,7 +12,7 @@ help:
 	@echo "  lint        Run regal lint (requires regal on PATH)"
 	@echo "  test        Run opa test for every rule and gate"
 	@echo "  build       Build OPA bundles into dist/"
-	@echo "  publish     Publish bundles to Gitea generic registry (needs GITEA_TOKEN)"
+	@echo "  publish     Publish bundles to Gitea generic registry (needs GITEA_TOKEN env)"
 	@echo "  changeset   Create a changeset for a new version"
 	@echo "  version     Apply changesets to bump package versions"
 
diff --git a/README.md b/README.md
index 77d9815..ce1947b 100644
--- a/README.md
+++ b/README.md
@@ -127,6 +127,9 @@ make publish  # upload all bundles to the Gitea generic registry
 - `GITEA_URL` (default `https://gitea.devegamoreno.com`)
 - `GITEA_OWNER` (default `jdevega`)
 
+In CI, set a secret named `DEPLOY_TOKEN` on the repository — the secret name must not start with
+the reserved `GITEA_` prefix — and `publish.sh` exposes it to the job as `GITEA_TOKEN`.
+
 Artifacts land at:
 
 ```
@@ -147,9 +150,10 @@ generated changeset. Later run `make version` to apply them. See
 `.gitea/workflows/ci.yml`:
 
 1. `verify` — `npm ci`, install OPA, `scripts/check.sh`, `scripts/build.sh` (every push/PR).
-2. `publish` — on `main` only, rebuilds and uploads bundles with `GITEA_TOKEN`.
+2. `publish` — on `main` only, rebuilds and uploads bundles with the `DEPLOY_TOKEN` secret.
 
-Create the `GITEA_TOKEN` repository secret on Gitea with at least `write:package` scope.
+Create the `DEPLOY_TOKEN` repository secret on Gitea with at least `write:package` scope
+(secret names cannot start with `GITEA_`).
 
 ## Evaluating a bundle
 
diff --git a/docs/tech-stack.md b/docs/tech-stack.md
index 4d6b074..df4fc1a 100644
--- a/docs/tech-stack.md
+++ b/docs/tech-stack.md
@@ -49,8 +49,9 @@
 
 ## Integration points
 
-- **Gitea Actions** reads `secrets.GITEA_TOKEN` (scope `write:package`) and
-  `GITEA_OWNER`/`GITEA_URL`; publish job runs only on `main`.
+- **Gitea Actions** reads the `DEPLOY_TOKEN` secret (scope `write:package`) and
+  `GITEA_OWNER`/`GITEA_URL`; publish job runs only on `main`. Secret names must not start with
+  the reserved `GITEA_` prefix.
 - **`scripts/publish.sh`** uploads via `curl` to the generic registry; package names are
   prefixed `rule-*` and `gate-*`.
 - **Consumer contract**: bundles scope roots to `rules` so operators can supply