diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 704aefd..5c946c2 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -95,23 +95,26 @@ jobs:
 
       - name: Publish Release (tags only)
         if: startsWith(github.ref, 'refs/tags/v')
+        env:
+          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
         run: |
+          set -euo pipefail
           VERSION=${GITHUB_REF#refs/tags/}
           API="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
           echo "==> Creating release ${VERSION}..."
 
           # Supprimer release existante (idempotent)
-          EXISTING=$(curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" "${API}/releases/tags/${VERSION}")
+          EXISTING=$(curl -sf -H "Authorization: token ${RELEASE_TOKEN}" "${API}/releases/tags/${VERSION}")
           EXISTING_ID=$(echo "$EXISTING" | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2)
           if [ -n "$EXISTING_ID" ]; then
             echo "  Deleting existing release #${EXISTING_ID}..."
-            curl -sf -X DELETE -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" "${API}/releases/${EXISTING_ID}"
+            curl -sf -X DELETE -H "Authorization: token ${RELEASE_TOKEN}" "${API}/releases/${EXISTING_ID}"
           fi
 
           # Creer la release
           BODY="## ntfy-bridge ${VERSION}\n\nBinaires statiques — zero dependance.\n\n### Linux\n- \`ntfy-bridge-linux-x86_64\` (x86_64)\n- \`ntfy-bridge-linux-arm64\` (Raspberry Pi)\n\n### Windows\n- \`ntfy-bridge-windows-x86_64.exe\`"
           RESP=$(curl -sf -X POST \
-            -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+            -H "Authorization: token ${RELEASE_TOKEN}" \
             -H "Content-Type: application/json" \
             -d "{\"tag_name\":\"${VERSION}\",\"name\":\"${VERSION}\",\"body\":\"${BODY}\",\"draft\":false,\"prerelease\":false}" \
             "${API}/releases")
@@ -124,7 +127,7 @@ jobs:
             FNAME=$(basename "$FILE")
             echo "  Uploading ${FNAME}..."
             curl -sf -X POST \
-              -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+              -H "Authorization: token ${RELEASE_TOKEN}" \
               -H "Content-Type: application/octet-stream" \
               --data-binary "@${FILE}" \
               "${API}/releases/${RELEASE_ID}/assets?name=${FNAME}"