diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d737fc2..ff79003 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,6 +35,14 @@ jobs:
       IMAGE: ghcr.io/thedancingdeveloper-org/rustnzbd
     steps:
       - uses: actions/checkout@v7
+      # Authenticate to Docker Hub first -- setup-qemu-action pulls its
+      # binfmt image from Docker Hub too, and doing that unauthenticated
+      # hits the shared runner's unauthenticated pull rate limit.
+      - name: Authenticate to Docker Hub (higher pull rate limit for base images)
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
       - uses: docker/setup-qemu-action@v4
       - uses: docker/setup-buildx-action@v4
       - uses: docker/login-action@v4
@@ -47,11 +55,6 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GHCR_TOKEN }}
-      - name: Authenticate to Docker Hub (higher pull rate limit for base images)
-        uses: docker/login-action@v4
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Build and publish multi-architecture release image once
         uses: docker/build-push-action@v7
         with: