diff --git a/.github/workflows/deploy-client.yml b/.github/workflows/deploy-client.yml
index 89633a5..af9b2a9 100644
--- a/.github/workflows/deploy-client.yml
+++ b/.github/workflows/deploy-client.yml
@@ -21,6 +21,9 @@ jobs:
           app-id: ${{ vars.RIOTBYTE_BOT_APP_ID }}
           private-key: ${{ secrets.RIOTBYTE_BOT_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
+          # Empty = installation-wide; needed to fetch @riotbyte-com
+          # packages published from sibling repos.
+          repositories: ""
 
       - uses: pnpm/action-setup@v4
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 970903a..99465c6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,6 +21,11 @@ jobs:
           app-id: ${{ vars.RIOTBYTE_BOT_APP_ID }}
           private-key: ${{ secrets.RIOTBYTE_BOT_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
+          # Empty repositories list = installation-wide access. Without
+          # this, the token is scoped to the current repo only and 403s
+          # when fetching packages from sibling repos (project-q,
+          # nest-service-locator, ...).
+          repositories: ""
 
       - uses: docker/setup-qemu-action@v3
       - uses: docker/setup-buildx-action@v3