diff --git a/.gitea/workflows/android-build.yml b/.gitea/workflows/android-build.yml
index 0c32762..a650852 100644
--- a/.gitea/workflows/android-build.yml
+++ b/.gitea/workflows/android-build.yml
@@ -1,7 +1,7 @@
 name: Android build
 
 permissions:
-  contents: read
+  contents: write
   releases: write
 
 on:
@@ -161,13 +161,19 @@ jobs:
         if: github.event_name == 'release'
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
         shell: bash
         run: |
           set -euxo pipefail
+          token="${GITEA_TOKEN:-${GITHUB_TOKEN:-}}"
+          if [ -z "$token" ]; then
+            echo "::error::No release upload token is available from secrets.GITEA_TOKEN or github.token"
+            exit 1
+          fi
           release_id="$(python3 -c 'import json, os; print(json.load(open(os.environ["GITHUB_EVENT_PATH"], encoding="utf-8"))["release"]["id"])')"
           aab="${{ steps.release_aab.outputs.path }}"
           curl --fail-with-body \
             --request POST \
-            --header "Authorization: token ***" \
+            --header "Authorization: token ${token}" \
             --form "attachment=@${aab}" \
             "${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/releases/${release_id}/assets?name=$(basename "$aab")"