diff --git a/app/Mcp/Tools/ManageRegistry.php b/app/Mcp/Tools/ManageRegistry.php
index 4fd94f0324..39fa20c6bb 100644
--- a/app/Mcp/Tools/ManageRegistry.php
+++ b/app/Mcp/Tools/ManageRegistry.php
@@ -11,14 +11,14 @@ class ManageRegistry extends RestActionTool
 {
     protected string $name = 'manage_registry';
 
-    protected string $description = 'List, add, check, or remove Docker registry logins on a server of the authenticated team. Passwords are never returned. Requires read:sensitive ability for list, deploy ability for create, write ability for check and delete. Same validation and permissions as the REST API.';
+    protected string $description = 'List, add, check, or remove Docker registry logins on a server of the authenticated team. Passwords are never returned. Requires read:sensitive ability for list, deploy ability for create and check, delete ability for delete. Same validation and permissions as the REST API.';
 
     protected function actions(): array
     {
         return [
             'list' => ['method' => 'GET', 'path' => 'servers/{uuid}/registries', 'ability' => 'read:sensitive', 'description' => 'registry logins on the server (registry and username only)'],
             'create' => ['method' => 'POST', 'path' => 'servers/{uuid}/registries', 'ability' => 'deploy', 'description' => 'log in to a registry on the server (data: registry, username, password)'],
-            'check' => ['method' => 'POST', 'path' => 'servers/{uuid}/registries/{registry}/check', 'ability' => 'write', 'description' => 'check that a registry login works'],
+            'check' => ['method' => 'POST', 'path' => 'servers/{uuid}/registries/{registry}/check', 'ability' => 'deploy', 'description' => 'check that a registry login works'],
             'delete' => ['method' => 'DELETE', 'path' => 'servers/{uuid}/registries/{registry}', 'ability' => 'delete', 'confirm' => true, 'description' => 'log out of a registry; private image pulls can fail afterwards'],
         ];
     }
diff --git a/tests/Feature/Mcp/McpServerToolsTest.php b/tests/Feature/Mcp/McpServerToolsTest.php
index 4a1ed112cd..c77d591be7 100644
--- a/tests/Feature/Mcp/McpServerToolsTest.php
+++ b/tests/Feature/Mcp/McpServerToolsTest.php
@@ -432,7 +432,7 @@ test('manage_registry lists registry logins without passwords', function () {
 });
 
 test('manage_registry list needs read:sensitive', function () {
-    $response = mcpSrvCall(mcpSrvToken($this->user, ['read', 'write']), 'manage_registry', ['action' => 'list', 'uuid' => $this->server->uuid]);
+    $response = mcpSrvCall(mcpSrvToken($this->user, ['read', 'write', 'deploy']), 'manage_registry', ['action' => 'list', 'uuid' => $this->server->uuid]);
 
     expect(mcpSrvIsError($response))->toBeTrue()
         ->and(mcpSrvText($response))->toContain('read:sensitive');