GKE の Pod で private repo の GHCR から docker image を pull する時にエラーが発生

Failed to pull image "ghcr.io/organization/repository:pr-1": rpc error: code = Unknown desc = failed to pull and unpack image "ghcr.io/organization/repository:pr-1": failed to resolve reference "ghcr.io/organization/repository:pr-1": pulling from host ghcr.io failed with status code [manifests pr-1]: 403 Forbidden

imagePullSecretsなどは合っているはずだったがpullできず苦戦
organizationのPersonal access tokensの設定でPersonal access token (classic)がRestrict access via personal access tokens (classic)になっていた...