diff --git a/.gitea/workflows/release-node.yml b/.gitea/workflows/release-node.yml
index 084803f..b97b369 100644
--- a/.gitea/workflows/release-node.yml
+++ b/.gitea/workflows/release-node.yml
@@ -58,9 +58,13 @@ jobs:
 
       - name: Configure npm auth for Gitea
         env:
-          NPM_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
         run: |
           set -euo pipefail
+          if [ -z "${NPM_TOKEN:-}" ]; then
+            echo "::error::NPM_PUBLISH_TOKEN secret is not set (needs Gitea token with write:package scope)" >&2
+            exit 1
+          fi
           echo "@kuns:registry=https://${NPM_REGISTRY_HOST}" > .npmrc
           echo "//${NPM_REGISTRY_HOST}:_authToken=${NPM_TOKEN}" >> .npmrc