diff --git a/app/services/auth/container_registry_authentication_service.rb b/app/services/auth/container_registry_authentication_service.rb
index c61d339ffdddf0a9ac66d35d0625dbe602fcb18e..72d28af7f7db2795292cf38078f5b12b39aafc7b 100644
--- a/app/services/auth/container_registry_authentication_service.rb
+++ b/app/services/auth/container_registry_authentication_service.rb
@@ -6,9 +6,9 @@ module Auth
       return error('not found', 404) unless registry.enabled
 
       if params[:offline_token]
-        return error('forbidden', 403) unless current_user
+        return error('forbidden', 401) unless current_user
       else
-        return error('forbidden', 401) unless scope
+        return error('forbidden', 403) unless scope
       end
 
       { token: authorized_token(scope).encoded }
diff --git a/spec/services/auth/container_registry_authentication_service_spec.rb b/spec/services/auth/container_registry_authentication_service_spec.rb
index 4a6cd132e8d24ad786c3ac29dd4d0bd40d11b93d..3ea252ed44fd5d7fb0d4e84b0d8a832b04fcc513 100644
--- a/spec/services/auth/container_registry_authentication_service_spec.rb
+++ b/spec/services/auth/container_registry_authentication_service_spec.rb
@@ -57,11 +57,6 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
     end
   end
 
-  shared_examples 'a unauthorized' do
-    it { is_expected.to include(http_status: 401) }
-    it { is_expected.to_not include(:token) }
-  end
-
   shared_examples 'a forbidden' do
     it { is_expected.to include(http_status: 403) }
     it { is_expected.to_not include(:token) }
@@ -116,7 +111,7 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
         { scope: "repository:#{project.path_with_namespace}:pull,push" }
       end
 
-      it_behaves_like 'a unauthorized'
+      it_behaves_like 'a forbidden'
     end
   end
 
@@ -154,7 +149,7 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
 
         context 'disallow for private' do
           let(:project) { create(:empty_project, :private) }
-          it_behaves_like 'a unauthorized'
+          it_behaves_like 'a forbidden'
         end
       end
 
@@ -165,7 +160,7 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
 
         context 'disallow for all' do
           let(:project) { create(:empty_project, :public) }
-          it_behaves_like 'a unauthorized'
+          it_behaves_like 'a forbidden'
         end
       end
     end
@@ -185,7 +180,7 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
         { scope: 'invalid:aa:bb' }
       end
 
-      it_behaves_like 'a unauthorized'
+      it_behaves_like 'a forbidden'
     end
 
     context 'for private project' do
@@ -195,7 +190,7 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
         { scope: "repository:#{project.path_with_namespace}:pull" }
       end
 
-      it_behaves_like 'a unauthorized'
+      it_behaves_like 'a forbidden'
     end
 
     context 'for public project' do
@@ -214,7 +209,7 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
           { scope: "repository:#{project.path_with_namespace}:push" }
         end
 
-        it_behaves_like 'a unauthorized'
+        it_behaves_like 'a forbidden'
       end
     end
   end