diff --git a/.gitea/workflows/build-and-publish.yaml b/.gitea/workflows/build-and-publish.yaml
index b0c0200..ddaf12e 100644
--- a/.gitea/workflows/build-and-publish.yaml
+++ b/.gitea/workflows/build-and-publish.yaml
@@ -89,8 +89,14 @@ jobs:
           minor="${rest%%.*}"
           patch="${rest##*.}"
 
+          # workflow_dispatch releases too, so a release can be cut without a
+          # code change -- the push filter above ignores workflow and doc edits.
+          # Restricted to main: a manual run elsewhere must not tag a commit
+          # that is not on the default branch.
           release="false"
-          if [ "${GITHUB_EVENT_NAME}" = "push" ] && [ "$bump" != "none" ]; then
+          if [ "${GITHUB_EVENT_NAME}" != "pull_request" ] \
+             && [ "${GITHUB_REF_NAME}" = "main" ] \
+             && [ "$bump" != "none" ]; then
             release="true"
             case "$bump" in
               major) major=$((major + 1)); minor=0; patch=0 ;;
@@ -127,7 +133,7 @@ jobs:
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.repository_owner }}
-          password: ${{ secrets.PACKAGES_SECRET }}
+          password: ${{ secrets.PACKAGES_TOKEN }}
 
       - name: Build and push
         uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7