diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 4e9d948..2532990 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -2,8 +2,8 @@ name: Release
 
 # A v* tag builds the Arch package natively per arch and uploads it to the
 # [uhhm] registry (namespace bl, as pacman.conf points there). REGISTRY_TOKEN
-# is a bl write:package token added as a repo secret; org repos do not inherit
-# user-level secrets.
+# is the uhhm org's action secret (a bl write:package token), which every
+# repo in the org inherits; nothing to add per repo.
 on:
   push:
     tags:
diff --git a/README.md b/README.md
index 0d85a99..424680a 100644
--- a/README.md
+++ b/README.md
@@ -95,5 +95,5 @@ Or build it: `cargo build --release`, or `makepkg` at the repo root.
 Bump `version` in `Cargo.toml` and `pkgver` in `PKGBUILD` to the same string,
 commit, tag `vX.Y.Z`. CI refuses a tag that disagrees with either. Gitea
 Actions then builds the package natively on both arches and uploads it to the
-registry. The `REGISTRY_TOKEN` repo secret is a bl `write:package` token; org
-repos do not inherit it.
+registry, authenticated with the uhhm org's `REGISTRY_TOKEN` action secret,
+which every repo in the org inherits.