diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index e9a11a5..bebec18 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -22,6 +22,11 @@ jobs:
       # Pin to a specific tag here (see build-image/VERSION) if you need a
       # release build to be reproducible against an exact toolchain image.
       image: cr.ladkau.de/schwert-und-magie/builder:latest
+      # Lets the runner pull a private image without a manual `docker login`
+      # on the runner host — see docs/publish.md §4.3.
+      credentials:
+        username: ${{ secrets.REGISTRY_USER }}
+        password: ${{ secrets.REGISTRY_PASSWORD }}
 
     steps:
       - uses: actions/checkout@v4
diff --git a/README.md b/README.md
index dc5d361..11d174d 100644
--- a/README.md
+++ b/README.md
@@ -159,6 +159,7 @@ publishes a Gitea Release with the versioned artifacts attached — see
    |---|---|
    | `RELEASE_KEYSTORE_B64` | `base64 -w0 SchwertUndMagieOnPebbleCompanionApp/release.keystore` |
    | `RELEASE_KEYSTORE_PROPERTIES` | full contents of `SchwertUndMagieOnPebbleCompanionApp/keystore.properties` |
+   | `REGISTRY_USER` / `REGISTRY_PASSWORD` | same as in `registry.env`, so the runner can pull the private build image |
 
    `GITEA_TOKEN` is injected automatically per job — nothing to add for it.
 4. `git tag v1.2.3 && git push origin v1.2.3`.
diff --git a/docs/publish.md b/docs/publish.md
index 0705afa..4d133cb 100644
--- a/docs/publish.md
+++ b/docs/publish.md
@@ -296,9 +296,10 @@ line in `.gitea/workflows/release.yml` to the versioned tag instead.
    in `.gitea/workflows/release.yml` — edit both together if you rename it,
    or reuse a label an existing runner already advertises (check Site Admin →
    Actions → Runners) to skip registering a new one entirely.
-4. The runner's Docker daemon needs pull access to the registry — run
-   `docker login <registry>` once on that machine with the same credentials
-   as `registry.env`.
+
+   No manual `docker login` needed on the runner host — the workflow's
+   `container:` block authenticates the image pull itself via the
+   `REGISTRY_USER`/`REGISTRY_PASSWORD` secrets (§4.3).
 
 ### 4.3 Repo secrets
 
@@ -308,6 +309,8 @@ Settings → Actions → Secrets, add:
 |---|---|
 | `RELEASE_KEYSTORE_B64` | `base64 -w0 SchwertUndMagieOnPebbleCompanionApp/release.keystore` |
 | `RELEASE_KEYSTORE_PROPERTIES` | the full contents of `SchwertUndMagieOnPebbleCompanionApp/keystore.properties` (§2.2) |
+| `REGISTRY_USER` | same as `REGISTRY_USER` in `registry.env` |
+| `REGISTRY_PASSWORD` | same as `REGISTRY_PASSWORD` in `registry.env` |
 
 `secrets.GITEA_TOKEN` (used to create the release and upload assets) is
 Gitea's own auto-generated per-job token — nothing to create or add yourself.