diff --git a/.gitea/workflows/docker.yml b/.gitea/workflows/docker.yml
index cc1a2aa..cada9f4 100644
--- a/.gitea/workflows/docker.yml
+++ b/.gitea/workflows/docker.yml
@@ -46,16 +46,19 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      # Build to OCI tar archives — no push yet.
-      # Gitea's registry token endpoint is incompatible with BuildKit's OAuth
-      # exchange; we push separately with skopeo which handles it correctly.
+      # Start a local registry so BuildKit can push multi-platform images
+      # without hitting Gitea's broken Bearer token endpoint. regctl then
+      # copies from localhost:5000 to Gitea using basic auth.
+      - name: Start local registry
+        run: docker run -d -p 5000:5000 --name local-registry registry:2
+
       - name: Build standard image
         uses: docker/build-push-action@v6
         with:
           context: .
           file: Dockerfile
-          push: false
-          outputs: type=oci,dest=/tmp/lmr-standard.tar
+          push: true
+          tags: localhost:5000/lmr:standard
           labels: ${{ steps.meta.outputs.labels }}
           platforms: linux/amd64,linux/arm64
           provenance: false
@@ -65,8 +68,8 @@ jobs:
         with:
           context: .
           file: Dockerfile.bundled
-          push: false
-          outputs: type=oci,dest=/tmp/lmr-bundled.tar
+          push: true
+          tags: localhost:5000/lmr:bundled
           labels: ${{ steps.meta-bundled.outputs.labels }}
           platforms: linux/amd64,linux/arm64
           provenance: false
@@ -78,9 +81,6 @@ jobs:
             -o /usr/local/bin/regctl
           chmod +x /usr/local/bin/regctl
 
-      # Write regctl config directly — avoids any flag compatibility issues and
-      # the broken Gitea Bearer token endpoint. authType=basic forces plain
-      # user:pass on every request with no token exchange.
       - name: Configure registry auth
         if: github.event_name != 'pull_request'
         env:
@@ -93,6 +93,7 @@ jobs:
           reg = os.environ["REGISTRY"]
           cfg = {
             "hosts": {
+              "localhost:5000": {"tls": "disabled"},
               reg: {
                 "user": os.environ["REGISTRY_USER"],
                 "pass": os.environ["REGISTRY_PASSWORD"],
@@ -114,7 +115,7 @@ jobs:
         run: |
           echo "$TAGS" | while IFS= read -r tag; do
             [ -z "$tag" ] && continue
-            regctl image copy "ociarchive:/tmp/lmr-standard.tar" "$tag"
+            regctl image copy "localhost:5000/lmr:standard" "$tag"
           done
 
       - name: Push bundled image
@@ -124,5 +125,5 @@ jobs:
         run: |
           echo "$TAGS" | while IFS= read -r tag; do
             [ -z "$tag" ] && continue
-            regctl image copy "ociarchive:/tmp/lmr-bundled.tar" "$tag"
+            regctl image copy "localhost:5000/lmr:bundled" "$tag"
           done