diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 2b1873f..900dc2a 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -68,29 +68,22 @@ jobs:
           VERSION: ${{ steps.version.outputs.version }}
         run: |
           set -euo pipefail
-          mkdir -p /root/.docker
-          AUTH=$(printf '%s:%s' "$REG_USER" "$REG_PASS" | base64 -w 0)
-          cat > /root/.docker/config.json <<EOF
-          {
-            "auths": {
-              "registry.c5ai.ch": {
-                "auth": "${AUTH}"
-              },
-              "https://registry.c5ai.ch": {
-                "auth": "${AUTH}"
-              },
-              "https://registry.c5ai.ch/v1/": {
-                "auth": "${AUTH}"
-              }
-            }
-          }
-          EOF
-
+          
+          # Build the image (docker daemon doesn't need auth for the build)
           docker build --pull \
             -t "${REGISTRY}/${IMAGE}:${VERSION}" \
             -t "${REGISTRY}/${IMAGE}:latest" .
-          docker push "${REGISTRY}/${IMAGE}:${VERSION}"
-          docker push "${REGISTRY}/${IMAGE}:latest"
+          
+          # Push with skopeo — always sends auth credentials, bypasses
+          # docker's challenge-retry logic that breaks with anonymous /v2/.
+          # skopeo copy reads creds from --src-creds / --dest-creds.
+          skopeo copy --dest-creds "$REG_USER:$REG_PASS" \
+            "docker-daemon:${REGISTRY}/${IMAGE}:${VERSION}" \
+            "docker://${REGISTRY}/${IMAGE}:${VERSION}"
+          
+          skopeo copy --dest-creds "$REG_USER:$REG_PASS" \
+            "docker-daemon:${REGISTRY}/${IMAGE}:latest" \
+            "docker://${REGISTRY}/${IMAGE}:latest"
 
       - name: Tag git commit with version
         env: