diff --git a/.gitea/workflows/iso-builder.yml b/.gitea/workflows/iso-builder.yml
index 1a178ed..9a12bd0 100644
--- a/.gitea/workflows/iso-builder.yml
+++ b/.gitea/workflows/iso-builder.yml
@@ -101,7 +101,7 @@ jobs:
       - name: Publish ${{ matrix.host }} ISO as a Gitea release
         if: ${{ github.event_name != 'workflow_dispatch' || inputs.publish-release }}
         env:
-          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.UPLOAD_TOKEN}}
         run: |
           set -euo pipefail
 
@@ -149,7 +149,21 @@ jobs:
 
           # Helper: parse the id field from a JSON body, returning "" on any error.
           extract_id() {
-            jq -r '.id // empty' 2>/dev/null || true
+            local body
+            body=$(cat)
+            if [ -z "$body" ]; then
+              echo "  (extract_id: empty body)" >&2
+              return 0
+            fi
+            # Print the id; suppress jq errors so non-JSON bodies don't abort.
+            local id
+            id=$(printf '%s' "$body" | jq -r '.id // empty' 2>/dev/null || true)
+            if [ -z "$id" ]; then
+              echo "  (extract_id: no .id field; body starts with:)" >&2
+              printf '%s' "$body" | head -c 300 >&2
+              echo >&2
+            fi
+            printf '%s' "$id"
           }
 
           # Create the release. Capture status + body separately so we can
@@ -160,9 +174,11 @@ jobs:
             -d "{\"tag_name\":\"$TAG\",\"name\":\"${{ matrix.host }} ISO $TAG\",\"body\":\"Automated ISO build for ${{ matrix.host }}.\\n\\nCommit: ${GITHUB_SHA}\\nRun: ${SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}\",\"prerelease\":$PRERELEASE}" \
             || true)
           echo "POST $API/releases -> HTTP $http_code"
+          echo "  create body size: $(wc -c < /tmp/release-create.body 2>/dev/null || echo 0) bytes"
           RELEASE_ID=""
           if [ "$http_code" = "201" ] || [ "$http_code" = "200" ]; then
             RELEASE_ID=$(extract_id < /tmp/release-create.body)
+            echo "  parsed RELEASE_ID from create: '${RELEASE_ID}'"
           else
             # Common case: tag already exists from a prior run. Show the body
             # for any other error so it's debuggable.
@@ -176,8 +192,10 @@ jobs:
             http_code=$(curl -sS -o /tmp/release-lookup.body -w '%{http_code}' \
               -H "$AUTH" "$API/releases/tags/$TAG" || true)
             echo "GET $API/releases/tags/$TAG -> HTTP $http_code"
+            echo "  lookup body size: $(wc -c < /tmp/release-lookup.body 2>/dev/null || echo 0) bytes"
             if [ "$http_code" = "200" ]; then
               RELEASE_ID=$(extract_id < /tmp/release-lookup.body)
+              echo "  parsed RELEASE_ID from lookup: '${RELEASE_ID}'"
             else
               echo "Lookup response body (first 2000 bytes):"
               head -c 2000 /tmp/release-lookup.body || true