diff --git a/.gitea/workflows/docker.yml b/.gitea/workflows/docker.yml
index 899abbe..ea8c877 100644
--- a/.gitea/workflows/docker.yml
+++ b/.gitea/workflows/docker.yml
@@ -29,9 +29,20 @@ jobs:
         run: docker version
 
       - name: Log in to the Gitea registry
+        env:
+          # The username is only needed to pair with the token. Default it to the
+          # repository owner — the same account the image namespace belongs to —
+          # so a missing REGISTRY_USER secret does not fail the job with docker's
+          # unhelpful "username is empty".
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER || github.repository_owner }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
-          echo "${{ secrets.REGISTRY_TOKEN }}" \
-            | docker login "$REGISTRY" -u "${{ secrets.REGISTRY_USER }}" --password-stdin
+          if [ -z "$REGISTRY_USER" ] || [ -z "$REGISTRY_TOKEN" ]; then
+            echo "::error::Container registry credentials are missing. Set REGISTRY_TOKEN (a token with package:write) under Settings → Actions → Secrets; REGISTRY_USER is optional and defaults to the repository owner."
+            exit 1
+          fi
+          printf '%s' "$REGISTRY_TOKEN" \
+            | docker login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
 
       - name: Build
         run: |
diff --git a/README.md b/README.md
index 35afb37..99d24e5 100644
--- a/README.md
+++ b/README.md
@@ -299,7 +299,7 @@ Secrets, all under *Repository → Settings → Actions → Secrets*:
 
 | Secret | For |
 | --- | --- |
-| `REGISTRY_USER`, `REGISTRY_TOKEN` | pushing to the Gitea registry (a token with `package:write`) |
+| `REGISTRY_TOKEN` | pushing to the Gitea registry (a token with `package:write`); `REGISTRY_USER` is optional and defaults to the repository owner |
 | `KADENCE_KEYSTORE_BASE64` | `base64 -w0 your.keystore` |
 | `KADENCE_KEYSTORE_PASSWORD`, `KADENCE_KEY_ALIAS`, `KADENCE_KEY_PASSWORD` | the key inside it |