diff --git a/.github/workflows/agenthits-image.yml b/.github/workflows/agenthits-image.yml
index a191f1bd33c..720a7b3f420 100644
--- a/.github/workflows/agenthits-image.yml
+++ b/.github/workflows/agenthits-image.yml
@@ -72,8 +72,12 @@ jobs:
         uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          # The image package belongs to the agentHits account, and a
+          # personal-account package cannot give Actions access to a
+          # repository of an organization, so GHCR refuses the job token here
+          # and the push needs a token of the package owner.
+          username: ${{ secrets.GHCR_PUSH_TOKEN && 'agentHits' || github.actor }}
+          password: ${{ secrets.GHCR_PUSH_TOKEN || secrets.GITHUB_TOKEN }}
 
       - name: Build and push image
         uses: docker/build-push-action@v7