This was not mentioned anywhere, so I want to add another possible cause of a 403 error when pulling an image from GHCR. I had a user with an admin role directly assigned in the package permissions who was still getting a 403.

It turned out that the organization had “maximum lifetimes for personal access tokens” enabled, while the user’s token had no expiry set.