diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d62c247..a39c4c2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -485,7 +485,33 @@ jobs:
           REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
           REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
         run: |
-          set -euo pipefail
+          set -eu
+
+          # Checked before use, because an unset secret is not an error anywhere upstream of
+          # here: ${{ }} renders a missing value as the empty string, so docker is handed
+          # --username "" and answers with something about credentials, which sends people
+          # to the registry to debug a value that never left the settings page.
+          #
+          # Reported by length, and never by value. Gitea masks known secret values in logs,
+          # but a mask is only as good as the runner's bookkeeping and a length answers the
+          # only question being asked: did anything arrive.
+          missing=""
+          [ -n "${REGISTRY_USERNAME:-}" ] || missing="$missing REGISTRY_USERNAME"
+          [ -n "${REGISTRY_PASSWORD:-}" ] || missing="$missing REGISTRY_PASSWORD"
+
+          if [ -n "$missing" ]; then
+            echo "Empty or unset:$missing" >&2
+            echo >&2
+            echo "Both come from repository secrets, which in Gitea are at" >&2
+            echo "  Settings -> Actions -> Secrets" >&2
+            echo "and are a different page from Settings -> Actions -> Variables. A value" >&2
+            echo "added as a variable is invisible to the secrets context and arrives here" >&2
+            echo "as an empty string, which is exactly what this message means." >&2
+            exit 1
+          fi
+
+          echo "username: ${#REGISTRY_USERNAME} characters; password: set"
+
           printf '%s' "$REGISTRY_PASSWORD" \
             | docker login registry-docker.dodotech.cloud \
                 --username "$REGISTRY_USERNAME" --password-stdin