diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index 95efdb0..140a38f 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -104,6 +104,8 @@ jobs:
           fetch-depth: 0
 
       - name: Log in to registry
+        # Only the push step needs it, and PR builds get no secrets.
+        if: github.event_name != 'pull_request'
         env:
           REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
           REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}