diff --git a/README.md b/README.md
index 153154a..9b9eee7 100644
--- a/README.md
+++ b/README.md
@@ -3,9 +3,10 @@
 Composite Gitea Action that builds a container image with buildx and optionally
 runs a smoke test. **Does not push** — pair with `action/image-push` to publish.
 
-Splitting build from push lets a PR workflow run `image-build` (no secrets, no
-side effects) for validation while `main` runs the full build → push → deploy
-chain.
+Splitting build from push lets a PR workflow run `image-build` without push or
+deploy side effects while `main` runs the full build → push → deploy chain. A
+PR build that pulls a private base image still needs a registry token limited to
+the `read:package` capability; public-base builds need no token.
 
 ## Usage
 
@@ -14,12 +15,14 @@ chain.
 - uses: https://code.fritzlab.net/action/image-build@v1
   with:
     image: code.fritzlab.net/fritzlab/chrony
+    token: ${{ secrets.PACKAGE_READ_TOKEN }} # read:package; omit for public bases
     smoke-test: docker run --rm --entrypoint /usr/sbin/chronyd $IMAGE -v
 ```
 
 The image is built and tagged as `<image>:<github.run_number>` in the runner's
 local Docker daemon. Subsequent steps (e.g. `action/image-push`) can reference
-the same tag.
+the same tag. `PACKAGE_READ_TOKEN` is an example caller-chosen secret name; the
+contract is the token's `read:package` capability.
 
 ## Inputs
 
@@ -31,6 +34,7 @@ the same tag.
 | `build-args` | no | — | Multiline `KEY=VALUE` build args. Visible in `docker history` — never put secrets here. |
 | `secrets` | no | — | Multiline `id=VALUE` BuildKit secrets (`--secret`). For tokens the build needs (e.g. a ci-bot token to `go mod download` a private module) that must not leak into layers. Reference with `RUN --mount=type=secret,id=<id>`. |
 | `smoke-test` | no | — | Shell command run after build. `$IMAGE` is set to `<image>:<run_number>`. Non-zero exit fails the action. |
+| `token` | no | — | Registry token with `read:package` capability. Required to pull a private base image; omit for public bases. |
 
 ## Outputs
 
diff --git a/action.yaml b/action.yaml
index 5d865dc..585a441 100644
--- a/action.yaml
+++ b/action.yaml
@@ -37,10 +37,11 @@ inputs:
     default: ''
   token:
     description: |
-      ci-bot token (CI_BOT_TOKEN) for `docker login code.fritzlab.net`. Required
-      when the Dockerfile's FROM is a PRIVATE fritzlab image (e.g. FROM
-      code.fritzlab.net/fritzlab/base) — the org is `limited`, so buildx can't pull
-      it anonymously. Omit for public-base builds (e.g. base itself = FROM debian).
+      Registry token with `read:package` capability for
+      `docker login code.fritzlab.net`. Required when the Dockerfile's FROM is a
+      PRIVATE fritzlab image (e.g. FROM code.fritzlab.net/fritzlab/base) — the
+      org is `limited`, so buildx can't pull it anonymously. Omit for public-base
+      builds (e.g. base itself = FROM debian).
     required: false
     default: ''
 outputs: