diff --git a/demo-config.yaml b/demo-config.yaml
index 1e6718a..539d037 100644
--- a/demo-config.yaml
+++ b/demo-config.yaml
@@ -1,5 +1,5 @@
 repository_identifier: simpl-open/platform-automation
 consumer_email: "consumer@example.local"
-access_level: read-only
+access_level: read
 token_name_prefix: simpl-open
 token_expiration_days: 30
\ No newline at end of file
diff --git a/src/simpl_open_credential_delivery/ops/generate_gitea_credentials.py b/src/simpl_open_credential_delivery/ops/generate_gitea_credentials.py
index bf9c233..adb717f 100644
--- a/src/simpl_open_credential_delivery/ops/generate_gitea_credentials.py
+++ b/src/simpl_open_credential_delivery/ops/generate_gitea_credentials.py
@@ -27,7 +27,7 @@ def _is_valid_email(value: str) -> bool:
         ),
         "access_level": Field(
             str,
-            default_value="read-only",
+            default_value="read",
             description="Requested repository access level",
         ),
         "token_name_prefix": Field(
diff --git a/tests/test_config_mapping.py b/tests/test_config_mapping.py
index b96191f..a44a2b3 100644
--- a/tests/test_config_mapping.py
+++ b/tests/test_config_mapping.py
@@ -10,7 +10,7 @@ def test_config_mapping_routes_inputs_to_ops():
         {
             "repository_identifier": "simpl-open/platform-automation",
             "consumer_email": "consumer@example.local",
-            "access_level": "read-only",
+            "access_level": "read",
             "token_name_prefix": "simpl-open",
             "token_expiration_days": 30,
         }
diff --git a/tests/test_generate_gitea_credentials.py b/tests/test_generate_gitea_credentials.py
index be075e7..8e60185 100644
--- a/tests/test_generate_gitea_credentials.py
+++ b/tests/test_generate_gitea_credentials.py
@@ -39,7 +39,7 @@ def test_generate_gitea_credentials_success(monkeypatch, op_context):
         op_config={
         "repository_identifier": "platform-automation",
         "consumer_email": "consumer@example.local",
-        "access_level": "read-only",
+        "access_level": "read",
         "token_name_prefix": "simpl-open",
         "token_expiration_days": 30,
         }
@@ -60,7 +60,7 @@ def test_generate_gitea_credentials_requires_gitea_base_url(monkeypatch, op_cont
         op_config={
         "repository_identifier": "simpl-open/platform-automation",
         "consumer_email": "consumer@example.local",
-        "access_level": "read-only",
+        "access_level": "read",
         "token_name_prefix": "simpl-open",
         "token_expiration_days": 30,
         }
diff --git a/tests/test_send_credentials_email.py b/tests/test_send_credentials_email.py
index 9d1095a..b36e1f3 100644
--- a/tests/test_send_credentials_email.py
+++ b/tests/test_send_credentials_email.py
@@ -52,7 +52,7 @@ def test_send_credentials_email_success(monkeypatch, op_context):
         {
             "repository_identifier": "simpl-open/platform-automation",
             "consumer_email": "consumer@example.local",
-            "access_level": "read-only",
+            "access_level": "read",
             "username": "application-consumer",
             "access_token": "token-123",
             "repository_access_url": "https://gitea.example.local/simpl-open/platform-automation",