diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 11160a9..fc8fd80 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -6,6 +6,10 @@ on:
       - 'v*'
   workflow_dispatch:
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   publish:
     runs-on: ubuntu-latest
@@ -14,9 +18,7 @@ jobs:
         shell: bash
     env:
       PIP_BREAK_SYSTEM_PACKAGES: "1"
-      # 显式 PATH,匹配宿主机自建的 python3.12
       PATH: /usr/local/bin:/usr/local/python3.12/bin:/usr/bin:/bin:/usr/local/sbin:/usr/sbin
-      # 国内镜像,避免 pypi.org 超时
       PIP_INDEX_URL: https://pypi.tuna.tsinghua.edu.cn/simple
       PIP_EXTRA_INDEX_URL: https://mirrors.aliyun.com/pypi/simple https://mirrors.cloud.tencent.com/pypi/simple https://mirrors.huaweicloud.com/repository/pypi/simple
       PIP_DEFAULT_TIMEOUT: "180"
@@ -33,8 +35,8 @@ jobs:
 
       - name: Publish to Gitea Package Registry
         env:
-          TWINE_USERNAME: ${{ secrets.GITEA_USERNAME }}
-          TWINE_PASSWORD: ${{ secrets.GITEA_TOKEN }}
+          TWINE_USERNAME: __token__
+          TWINE_PASSWORD: ${{ github.token }}
         run: |
           python3.12 -m twine upload \
             --repository-url https://git.jc2009.com/api/packages/client-jiangchang/pypi \