diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 1ddc340..6af6cfe 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -43,7 +43,8 @@ jobs:
         run: |
           set -eu
           REGISTRY="${GITHUB_SERVER_URL#https://}"
-          echo "${{ secrets.GITHUB_TOKEN }}" | docker login "${REGISTRY}" -u "${GITHUB_ACTOR}" --password-stdin
+          # GITHUB_TOKEN : login OK mais push → unauthorized: reqPackageAccess
+          echo "${{ secrets.PACKAGE_TOKEN }}" | docker login "${REGISTRY}" -u "${GITHUB_ACTOR}" --password-stdin
 
       - name: Build and push
         run: |