diff --git a/.gitea/scripts/wiki-push.sh b/.gitea/scripts/wiki-push.sh
index 494e514..bb80a90 100755
--- a/.gitea/scripts/wiki-push.sh
+++ b/.gitea/scripts/wiki-push.sh
@@ -19,8 +19,8 @@ version="${2:?usage: wiki-push.sh <output-dir> <version>}"
 
 if [ -z "${WIKI_TOKEN:-}" ]; then
   echo "ERROR WIKI_TOKEN is empty: the wiki mirror needs a token that may push to the wiki repository." >&2
-  echo "      The job token (gitea.token) is tried first; if Gitea refuses it, the operator adds a" >&2
-  echo "      repository secret with write access and the workflow passes that one instead." >&2
+  echo "      The job token (gitea.token) is used with 'permissions: wiki: write'; if Gitea still refuses it," >&2
+  echo "      the repository's Actions settings cap the token, or the operator adds a secret with write access." >&2
   exit 1
 fi
 [ -f "$out/Home.md" ] || { echo "ERROR $out/Home.md is missing - not a converter output" >&2; exit 1; }
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 684bdc1..9613f43 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -255,6 +255,7 @@ jobs:
       image: debian:trixie-slim
     permissions:
       contents: write
+      wiki: write
     env:
       VERSION: ${{ needs.release.outputs.version }}
       TAG: ${{ needs.release.outputs.tag }}
diff --git a/.gitea/workflows/wiki-mirror.yml b/.gitea/workflows/wiki-mirror.yml
index f697b7a..c30c145 100644
--- a/.gitea/workflows/wiki-mirror.yml
+++ b/.gitea/workflows/wiki-mirror.yml
@@ -29,6 +29,7 @@ jobs:
       image: debian:trixie-slim
     permissions:
       contents: write
+      wiki: write
     env:
       PUBLIC_BASE_URL: https://gitea.nehmer.net