diff --git a/.gitea/workflows/docker.yml b/.gitea/workflows/docker.yml
index 0944853..756bf3a 100644
--- a/.gitea/workflows/docker.yml
+++ b/.gitea/workflows/docker.yml
@@ -40,42 +40,58 @@ jobs:
             type=semver,pattern={{major}}.{{minor}},suffix=-bundled
             type=sha,prefix=sha-,format=short,suffix=-bundled
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      # Write credentials directly into config.json so BuildKit can read them
-      # without triggering the OAuth token exchange that Gitea doesn't support.
-      - name: Log in to registry
-        if: github.event_name != 'pull_request'
-        run: |
-          mkdir -p ~/.docker
-          printf '{"auths":{"%s":{"auth":"%s"}}}' \
-            "${{ env.REGISTRY }}" \
-            "$(printf '%s:%s' '${{ secrets.REGISTRY_USER }}' '${{ secrets.REGISTRY_PASSWORD }}' | base64 -w0)" \
-            > ~/.docker/config.json
-
-      - name: Build and push — standard
+      # Build to OCI tar archives — no push yet.
+      # Gitea's registry token endpoint is incompatible with BuildKit's OAuth
+      # exchange; we push separately with skopeo which handles it correctly.
+      - name: Build standard image
         uses: docker/build-push-action@v6
         with:
           context: .
           file: Dockerfile
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta.outputs.tags }}
+          push: false
+          outputs: type=oci,dest=/tmp/lmr-standard.tar
           labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE }}:cache
-          cache-to: ${{ github.event_name != 'pull_request' && format('type=registry,ref={0}/{1}:cache,mode=max', env.REGISTRY, env.IMAGE) || '' }}
           platforms: linux/amd64,linux/arm64
           provenance: false
 
-      - name: Build and push — bundled (postgres included)
+      - name: Build bundled image
         uses: docker/build-push-action@v6
         with:
           context: .
           file: Dockerfile.bundled
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta-bundled.outputs.tags }}
+          push: false
+          outputs: type=oci,dest=/tmp/lmr-bundled.tar
           labels: ${{ steps.meta-bundled.outputs.labels }}
-          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE }}:cache-bundled
-          cache-to: ${{ github.event_name != 'pull_request' && format('type=registry,ref={0}/{1}:cache-bundled,mode=max', env.REGISTRY, env.IMAGE) || '' }}
           platforms: linux/amd64,linux/arm64
           provenance: false
+
+      # Push with skopeo which uses basic auth and works with Gitea's registry.
+      - name: Push standard image
+        if: github.event_name != 'pull_request'
+        env:
+          CREDS: ${{ secrets.REGISTRY_USER }}:${{ secrets.REGISTRY_PASSWORD }}
+        run: |
+          for tag in ${{ steps.meta.outputs.tags }}; do
+            skopeo copy --all \
+              oci-archive:/tmp/lmr-standard.tar \
+              docker://$tag \
+              --dest-creds="$CREDS"
+          done
+
+      - name: Push bundled image
+        if: github.event_name != 'pull_request'
+        env:
+          CREDS: ${{ secrets.REGISTRY_USER }}:${{ secrets.REGISTRY_PASSWORD }}
+        run: |
+          for tag in ${{ steps.meta-bundled.outputs.tags }}; do
+            skopeo copy --all \
+              oci-archive:/tmp/lmr-bundled.tar \
+              docker://$tag \
+              --dest-creds="$CREDS"
+          done