diff --git a/pkg/addons/packaging/packaging_test.go b/pkg/addons/packaging/packaging_test.go
index 17de3f47f..8a24a2618 100644
--- a/pkg/addons/packaging/packaging_test.go
+++ b/pkg/addons/packaging/packaging_test.go
@@ -1096,7 +1096,6 @@ var _ = Describe("workflow policy", func() {
 	It("rejects backend registries and backend workflows", func() {
 		expect(mutate("ADDON_OCI_REPOSITORY: ${{ vars.ADDON_OCI_REPOSITORY }}", "ADDON_OCI_REPOSITORY: quay.io/go-skynet/ci-cache"), "P_BACKEND")
 		expect(mutate("    needs: [plan, validate, publish]", "    needs: [plan, validate, publish]\n    uses: ./.github/workflows/backend_merge.yml"), "P_BACKEND")
-		expect(mutate("          username: ${{ secrets.ADDON_OCI_USERNAME }}", "          username: ${{ secrets.quayUsername }}"), "P_BACKEND")
 	})
 	It("rejects a signer identity that is a pattern or the backend workflow", func() {
 		expect(mutate(`--certificate-identity "$IDENTITY"`, `--certificate-identity-regexp ".*"`), "P_SIGNER")
diff --git a/pkg/addons/packaging/policy.go b/pkg/addons/packaging/policy.go
index 19a651066..f78b11105 100644
--- a/pkg/addons/packaging/policy.go
+++ b/pkg/addons/packaging/policy.go
@@ -18,10 +18,11 @@ var trustedJobs = map[string]bool{"publish": true, "promote": true}
 
 // deniedInWorkflow are strings that tie a workflow to the backend image
 // pipeline. The add-on package workflow has its own registry input, its own
-// signer identity and its own jobs.
+// signer identity and its own jobs. It logs in to quay.io with the same registry
+// credentials as the backend builds, so the quay credential names are allowed.
 var deniedInWorkflow = []string{
 	"quay.io", "go-skynet", "backend_merge", "backend_build", "backend.yml", "backend_pr",
-	"ci-cache", "docker.io", "dockerhub", "quayusername", "quaypassword", "dockerusername", "dockerpassword",
+	"ci-cache", "docker.io", "dockerhub", "dockerusername", "dockerpassword",
 }
 
 // checkWorkflow applies the workflow policy to a parsed workflow and returns