diff --git a/.gitea/workflows/image-only.yml b/.gitea/workflows/image-only.yml
index 6c91d9b..effb08c 100644
--- a/.gitea/workflows/image-only.yml
+++ b/.gitea/workflows/image-only.yml
@@ -101,6 +101,12 @@ jobs:
           esac
 
       - name: Prune old container versions
+        # GC requires broader scope than REGISTRY_TOKEN's push perms
+        # (got HTTP 403 enumerating /packages/.../versions on run #122).
+        # Non-critical — housekeeping only. Don't fail the whole run.
+        # TODO: issue a separate PAT with admin:package scope and set
+        # as PACKAGES_ADMIN_TOKEN, then use it here.
+        continue-on-error: true
         env:
           GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
diff --git a/.gitea/workflows/refresh.yml b/.gitea/workflows/refresh.yml
index 4ea4894..61a899b 100644
--- a/.gitea/workflows/refresh.yml
+++ b/.gitea/workflows/refresh.yml
@@ -148,7 +148,11 @@ jobs:
           esac
 
       - name: Prune old container versions
+        # GC requires broader scope than REGISTRY_TOKEN's push perms
+        # (HTTP 403 on /packages/.../versions). Non-critical housekeeping.
+        # TODO: issue separate PAT with admin:package scope.
         if: steps.commit.outputs.changed == 'true' || inputs.force_build == true
+        continue-on-error: true
         env:
           GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |