diff --git a/.gitea/workflows/docker.yaml b/.gitea/workflows/docker.yaml
index 5e7ff27..3714568 100644
--- a/.gitea/workflows/docker.yaml
+++ b/.gitea/workflows/docker.yaml
@@ -1,6 +1,7 @@
 name: Build a docker image.
 
-on: [push]
+on:
+  push:
 
 jobs:
   build-docker-image:
@@ -10,25 +11,35 @@ jobs:
       - name: Check out repository code
         uses: actions/checkout@v4
 
-      - name: Build flake
-        run: nix build .#docker
-
-      - name: Load Docker image
-        run: docker load < result
-
-      - name: Login to local Gitea registry
+      - name: Build image
         run: |
-          echo "${{ secrets.GITEA_TOKEN }}" | \
-            docker login ${{ gitea.server_url }} \
-              --username "${{ gitea.actor }}" \
-              --password-stdin
-
-      - name: Tag image
-        run: |
-          docker tag my-image:latest \
-            ${{ gitea.server_url }}/${{ gitea.repository }}:latest
+          nix build .#docker
 
       - name: Push image
+        env:
+          REGISTRY: "${{ gitea.server_url }}"
+          REPOSITORY: "${{ gitea.repository }}"
+          USERNAME: "${{ gitea.actor }}"
+          PASSWORD: "${{ secrets.GITEA_TOKEN }}"
+          TAG: "${{ gitea.sha }}"
         run: |
-          docker push \
-            ${{ gitea.server_url }}/${{ gitea.repository }}:latest
+          REGISTRY="${REGISTRY#https://}"
+          REGISTRY="${REGISTRY#http://}"
+          REGISTRY="${REGISTRY%/}"
+
+          IMAGE="${REGISTRY}/${REPOSITORY}:${TAG}"
+
+          echo "Pushing ${IMAGE}"
+
+          skopeo copy \
+            --dest-creds "${USERNAME}:${PASSWORD}" \
+            "docker-archive:result" \
+            "docker://${IMAGE}"
+
+          # Also update latest
+          if [ "${GITEA_REF_TYPE}" = "branch" ] && [ "${GITEA_REF_NAME}" = "main" ]; then
+            skopeo copy \
+              --dest-creds "${USERNAME}:${PASSWORD}" \
+              "docker-archive:result" \
+              "docker://${REGISTRY}/${REPOSITORY}:latest"
+          fi