diff --git a/.github/workflows/publish-image.yml b/.github/workflows/publish-image.yml
index 2fad3e4..60775fb 100644
--- a/.github/workflows/publish-image.yml
+++ b/.github/workflows/publish-image.yml
@@ -50,11 +50,21 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
+      - name: Verify Docker Hub publishing credential
+        if: github.event_name != 'pull_request'
+        env:
+          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+        run: |
+          if [ -z "$DOCKERHUB_TOKEN" ]; then
+            echo "::error::Add the DOCKERHUB_TOKEN repository secret before publishing."
+            exit 1
+          fi
+
       - name: Sign in to Docker Hub
         if: github.event_name != 'pull_request'
         uses: docker/login-action@v4
         with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          username: kalebbroo
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Generate image metadata
diff --git a/README.md b/README.md
index 7e44f2f..f8bb0ea 100644
--- a/README.md
+++ b/README.md
@@ -18,12 +18,13 @@ docker.io/kalebbroo/runpod-serverless-aitoolkit:latest
 docker.io/kalebbroo/runpod-serverless-aitoolkit:sha-<full-git-commit>
 ```
 
-Configure these GitHub Actions repository secrets before merging the workflow:
+Configure this GitHub Actions repository secret before publishing:
 
-- `DOCKERHUB_USERNAME`: `kalebbroo`
 - `DOCKERHUB_TOKEN`: a Docker Hub personal access token with Read & Write permission
 
-Create the `kalebbroo/runpod-serverless-aitoolkit` Docker Hub repository first. Do not store a Docker Hub password or token in the repository. Use the immutable `sha-<full-git-commit>` tag in the RunPod template; `latest` is a convenience tag for inspection and manual testing.
+The public Docker Hub username `kalebbroo` is configured directly in the workflow and does not need to be stored as a secret.
+
+The first successful push creates `kalebbroo/runpod-serverless-aitoolkit` if it does not exist. Do not store a Docker Hub password or token in the repository. Use the immutable `sha-<full-git-commit>` tag in the RunPod template; `latest` is a convenience tag for inspection and manual testing.
 
 The workflow publishes BuildKit provenance and an SBOM with release images and uses the GitHub Actions cache for subsequent builds.