diff --git a/.forgejo/workflows/publish.yml b/.forgejo/workflows/publish.yml
index cd7df51..6b83a31 100644
--- a/.forgejo/workflows/publish.yml
+++ b/.forgejo/workflows/publish.yml
@@ -13,13 +13,68 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Build and publish image
-        uses: http://forgejo:3000/andras/ci-actions/docker-publish@main
+      - name: Install Docker CLI
+        run: |
+          ARCH=$(uname -m)
+          curl -fsSL "https://download.docker.com/linux/static/stable/${ARCH}/docker-27.5.1.tgz" \
+            | tar xz --strip-components=1 -C /usr/local/bin docker/docker
+          docker --version
+
+      - name: Set up Docker Buildx
+        uses: https://github.com/docker/setup-buildx-action@v3
+        with:
+          driver-opts: |
+            network=host
+
+      - name: Resolve registry vars
+        id: registry
+        env:
+          CONTAINER_REGISTRY_HOST: ${{ vars.CONTAINER_REGISTRY_HOST }}
+        run: |
+          host="${CONTAINER_REGISTRY_HOST:-${{ gitea.server_url }}}"
+          host="${host#https://}"
+          host="${host#http://}"
+          host="${host%/}"
+          if [ "$host" = "forgejo:3000" ]; then
+            host="127.0.0.1:13000"
+          fi
+          repo=$(echo "${{ gitea.repository }}" | tr '[:upper:]' '[:lower:]')
+          owner="${repo%%/*}"
+          {
+            echo "host=${host}"
+            echo "owner=${owner}"
+            echo "image=${host}/${repo}"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Log in to Forgejo Container Registry
+        uses: https://github.com/docker/login-action@v3
+        with:
+          registry: ${{ steps.registry.outputs.host }}
+          username: ${{ steps.registry.outputs.owner }}
+          password: ${{ secrets.FORGEJO_PACKAGE_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: https://github.com/docker/metadata-action@v5
+        with:
+          images: ${{ steps.registry.outputs.image }}
+          tags: |
+            type=sha,format=short
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+
+      - name: Build and push
+        uses: https://github.com/docker/build-push-action@v6
         with:
           context: .
+          push: true
           # The published image is deployed at https://schmelczer.dev/towers/,
           # so the SPA is built with that sub-path baked into <base href> and
           # the service-worker manifest. Change this if the deploy path changes.
           build-args: |
             BASE_HREF=/towers/
-          token: ${{ secrets.FORGEJO_PACKAGE_TOKEN }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=registry,ref=${{ steps.registry.outputs.image }}:buildcache
+          cache-to: type=registry,ref=${{ steps.registry.outputs.image }}:buildcache,mode=max