diff --git a/app/services/auth/container_registry_authentication_service.rb b/app/services/auth/container_registry_authentication_service.rb
index 0a06932093671f0fce3527d3358a7dfc05bd6389..9e7319c1d9bb45ef8d03ade39b944927c72d98d5 100644
--- a/app/services/auth/container_registry_authentication_service.rb
+++ b/app/services/auth/container_registry_authentication_service.rb
@@ -124,13 +124,21 @@ module Auth
         build_can_pull?(requested_project) || user_can_pull?(requested_project) || deploy_token_can_pull?(requested_project)
       when 'push'
         build_can_push?(requested_project) || user_can_push?(requested_project)
-      when '*', 'delete'
+      when 'delete'
+        build_can_delete?(requested_project) || user_can_admin?(requested_project)
+      when '*'
         user_can_admin?(requested_project)
       else
         false
       end
     end
 
+    def build_can_delete?(requested_project)
+      # Build can delete only from the project from which it originates
+      has_authentication_ability?(:build_destroy_container_image) &&
+        requested_project == project
+    end
+
     def registry
       Gitlab.config.registry
     end
diff --git a/changelogs/unreleased/40096-allow-ci-token-to-delete-from-registry.yml b/changelogs/unreleased/40096-allow-ci-token-to-delete-from-registry.yml
new file mode 100644
index 0000000000000000000000000000000000000000..3e5de08f6ae25bf82613ebd5a6c6d80f00027879
--- /dev/null
+++ b/changelogs/unreleased/40096-allow-ci-token-to-delete-from-registry.yml
@@ -0,0 +1,5 @@
+---
+title: Allow $CI_REGISTRY_USER to delete tags
+merge_request: 31796
+author:
+type: added
diff --git a/lib/gitlab/auth.rb b/lib/gitlab/auth.rb
index 6769bd95c2b45f8e75ad5b7e42471e47751950b4..bdc46abeb9fabe62ccd58426726843efd3ce78c3 100644
--- a/lib/gitlab/auth.rb
+++ b/lib/gitlab/auth.rb
@@ -265,7 +265,8 @@ module Gitlab
           :read_project,
           :build_download_code,
           :build_read_container_image,
-          :build_create_container_image
+          :build_create_container_image,
+          :build_destroy_container_image
         ]
       end
 
diff --git a/spec/lib/gitlab/auth_spec.rb b/spec/lib/gitlab/auth_spec.rb
index 098c33f9cb10aacfa6bc9a3d0dfb25e9c4be74cd..0365d63ea9c7b7ca6801cd53b1532fa738529f1e 100644
--- a/spec/lib/gitlab/auth_spec.rb
+++ b/spec/lib/gitlab/auth_spec.rb
@@ -587,7 +587,8 @@ describe Gitlab::Auth do
       :read_project,
       :build_download_code,
       :build_read_container_image,
-      :build_create_container_image
+      :build_create_container_image,
+      :build_destroy_container_image
     ]
   end
 
diff --git a/spec/services/auth/container_registry_authentication_service_spec.rb b/spec/services/auth/container_registry_authentication_service_spec.rb
index 3ca389ba25b9958297ffbc83aac9f92c38496bd1..2807b8c8c85667acc9c852aa8064795ba1d1477c 100644
--- a/spec/services/auth/container_registry_authentication_service_spec.rb
+++ b/spec/services/auth/container_registry_authentication_service_spec.rb
@@ -476,7 +476,7 @@ describe Auth::ContainerRegistryAuthenticationService do
     let(:current_user) { create(:user) }
 
     let(:authentication_abilities) do
-      [:build_read_container_image, :build_create_container_image]
+      [:build_read_container_image, :build_create_container_image, :build_destroy_container_image]
     end
 
     before do
@@ -507,19 +507,19 @@ describe Auth::ContainerRegistryAuthenticationService do
       end
     end
 
-    context 'disallow to delete images' do
+    context 'allow to delete images since registry 2.7' do
       let(:current_params) do
-        { scopes: ["repository:#{current_project.full_path}:*"] }
+        { scopes: ["repository:#{current_project.full_path}:delete"] }
       end
 
-      it_behaves_like 'an inaccessible' do
+      it_behaves_like 'a deletable since registry 2.7' do
         let(:project) { current_project }
       end
     end
 
-    context 'disallow to delete images since registry 2.7' do
+    context 'disallow to delete images' do
       let(:current_params) do
-        { scopes: ["repository:#{current_project.full_path}:delete"] }
+        { scopes: ["repository:#{current_project.full_path}:*"] }
       end
 
       it_behaves_like 'an inaccessible' do