diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index c9d4f05..0b07af8 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -121,7 +121,7 @@ jobs:
 
       - name: Record built state
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          STATE_PUSH_TOKEN: ${{ secrets.STATE_PUSH_TOKEN }}
         run: bash scripts/record-state.sh
 
       - name: Clean up build tree
diff --git a/README.md b/README.md
index abcb84f..4c6e7fb 100644
--- a/README.md
+++ b/README.md
@@ -77,7 +77,7 @@ Set these in the Gitea repo before the first run.
 | --- | --- |
 | `GH_TOKEN` | GitHub PAT with `contents: write` on the release repo |
 | `AUR_SSH_PRIVATE_KEY` | Private SSH key registered with your AUR account. Copy the value already set on `agw/pi3-smart-workspace`. |
-| `GITEA_TOKEN` | Token with write access to this repo, for committing `state.json` |
+| `STATE_PUSH_TOKEN` | Gitea token with write access to this repo, for committing `state.json`. (Gitea reserves the `GITEA_` secret prefix.) |
 
 The GitHub repo `GH_OWNER/GH_REPO` must exist and be public — the AUR PKGBUILD
 downloads the tarball from its releases, so it has to be reachable anonymously.
diff --git a/scripts/record-state.sh b/scripts/record-state.sh
index b88f848..44612e1 100755
--- a/scripts/record-state.sh
+++ b/scripts/record-state.sh
@@ -2,11 +2,11 @@
 # Commit state.json back to this repo so the next scheduled run knows what was
 # already built. Without this the daily check would rebuild every night.
 #
-#   GITEA_TOKEN   token with write access to this repo (required)
+#   STATE_PUSH_TOKEN   token with write access to this repo (required)
 
 set -euo pipefail
 
-: "${GITEA_TOKEN:?GITEA_TOKEN is required}"
+: "${STATE_PUSH_TOKEN:?STATE_PUSH_TOKEN is required}"
 
 python3 - <<'PY'
 import json
@@ -40,6 +40,6 @@ git commit -m "Record build of ${GITHUB_REF_NAME:-build}: $(python3 -c 'import j
 origin="$(git remote get-url origin)"
 host_path="${origin#*://}"
 host_path="${host_path#*@}"
-git push "https://x-access-token:${GITEA_TOKEN}@${host_path}" HEAD:"${GITHUB_REF_NAME:-master}"
+git push "https://x-access-token:${STATE_PUSH_TOKEN}@${host_path}" HEAD:"${GITHUB_REF_NAME:-master}"
 
 echo ":: state recorded"