diff --git a/docs/runbooks/credential-rotation.md b/docs/runbooks/credential-rotation.md
index f3970cf..e64b430 100644
--- a/docs/runbooks/credential-rotation.md
+++ b/docs/runbooks/credential-rotation.md
@@ -21,6 +21,21 @@ Include Forgejo API access, Flux source authentication, webhook authorization, T
 5. Validate each inventoried consumer: Forgejo authenticated operation, Flux source authentication and reconciliation readiness, webhook delivery authorization, Tekton trigger and PipelineRun behavior, and registry pull/push behavior. Record only identifiers, timestamps, and pass/fail status.
 6. If every validation passes during the overlap window, revoke the old credential through its owning system and repeat the affected consumer checks.
 
+## Forgejo registry package-write recovery
+
+Use this procedure when a Tekton image push fails with `401 Unauthorized: reqPackageAccess` for the target organization.
+
+1. Obtain approval for package write access to the named Forgejo organization. Do not reuse a repository-status token or a user-wide credential without this approval.
+2. From the configured MaidnCLI checkout, run the prompted command below. Enter the Forgejo password and optional OTP only at its secure prompts.
+
+   ```powershell
+   cicd-tool bootstrap --config <bootstrap-config> --create-forgejo-registry-token
+   ```
+
+3. The command creates or rotates the registry credential, saves its Docker configuration only in encrypted operational secrets, seeds OpenBao, and refreshes `tekton-pipelines/forgejo-registry-credentials`. Never copy the generated token or Docker configuration into a shell command, manifest, or report.
+4. Confirm the ExternalSecret is ready without reading Secret data, then retry one disposable PipelineRun targeting the approved organization. Record only the image repository, PipelineRun name, and pass/fail result.
+5. If the retry still returns `reqPackageAccess`, stop. Confirm the token owner has package write permission for the target organization and create a replacement through the same prompted command. Do not broaden application, Forgejo status, or webhook credentials as a workaround.
+
 ## Rollback
 
 If OpenBao reseed, readiness, External Secrets refresh, or any consumer validation fails, stop before revocation. Restore the previously encrypted operational-secret version, reseed OpenBao, verify readiness and all affected consumers, and keep the old credential active. Escalate if the previous encrypted version or recovery material is unavailable; do not reconstruct values from logs or configuration.