diff --git a/.github/workflows/release-candidate.yml b/.github/workflows/release-candidate.yml
index 548d52e130..7413a02e14 100644
--- a/.github/workflows/release-candidate.yml
+++ b/.github/workflows/release-candidate.yml
@@ -379,6 +379,10 @@ jobs:
     needs: [guard, publish]
     if: needs.guard.outputs.should_run == 'true' && needs.publish.outputs.vtag != ''
     uses: ./.github/workflows/docker.yml
+    # Reusable workflows do not receive caller secrets unless inherited; without
+    # this, DOCKERHUB_* / GITHUB_TOKEN are empty in docker.yml → "Username and
+    # password required" on Docker Hub login (see same pattern on `ci:` above).
+    secrets: inherit
     permissions:
       contents: read
       packages: write