diff --git a/.gitea/workflows/macos.yaml b/.gitea/workflows/macos.yaml
index d3cc05b..52fafce 100644
--- a/.gitea/workflows/macos.yaml
+++ b/.gitea/workflows/macos.yaml
@@ -35,9 +35,6 @@ on:
         description: Name of the checksum asset (use a per-platform name when several jobs release the same tag)
         type: string
         default: SHA256SUMS
-    secrets:
-      PACKAGES_TOKEN:
-        required: false
 
 permissions:
   contents: write
@@ -89,7 +86,8 @@ jobs:
         shell: bash
         env:
           ARTIFACTS: ${{ inputs.artifacts }}
-          TOKEN: ${{ secrets.PACKAGES_TOKEN || github.token }}
+          # The job token creates this repository's release (contents: write); no secret needed.
+          TOKEN: ${{ github.token }}
           TAG: ${{ github.ref_name }}
           CHECKSUMS: ${{ inputs.checksums }}
         run: |
diff --git a/.gitea/workflows/windows.yaml b/.gitea/workflows/windows.yaml
index 6f14fd5..9fcfc8d 100644
--- a/.gitea/workflows/windows.yaml
+++ b/.gitea/workflows/windows.yaml
@@ -34,9 +34,6 @@ on:
         description: Name of the checksum asset (use a per-platform name when several jobs release the same tag)
         type: string
         default: SHA256SUMS
-    secrets:
-      PACKAGES_TOKEN:
-        required: false
 
 permissions:
   contents: write
@@ -88,7 +85,8 @@ jobs:
         shell: pwsh
         env:
           ARTIFACTS: ${{ inputs.artifacts }}
-          TOKEN: ${{ secrets.PACKAGES_TOKEN || github.token }}
+          # The job token creates this repository's release (contents: write); no secret needed.
+          TOKEN: ${{ github.token }}
           TAG: ${{ github.ref_name }}
           CHECKSUMS: ${{ inputs.checksums }}
         run: |
diff --git a/README.md b/README.md
index fc9ef0c..7deb014 100644
--- a/README.md
+++ b/README.md
@@ -202,7 +202,8 @@ jobs:
   reports failure with `exit 1` must run as `pwsh -NoProfile -File x.ps1`; called
   with `&` it would not stop the script. Test tools that assert on child exit
   codes themselves (Pester suites) need `$PSNativeCommandUseErrorActionPreference = $false` first.
-- Releases use `PACKAGES_TOKEN` (or the job token). Re-running a tag replaces
+- Releases use the job token (`contents: write`); the org `PACKAGES_TOKEN` got
+  HTTP 403 on the release lookup. Re-running a tag replaces
   assets of the same name. A Homebrew or Scoop update can read the release's
   `SHA256SUMS`.
 - Host limits today: the Windows runner is a batch-logon task with no interactive