diff --git a/.forgejo/workflows/publish-cli-docker.yml b/.forgejo/workflows/publish-cli-docker.yml
index 265283ab..77f6c700 100644
--- a/.forgejo/workflows/publish-cli-docker.yml
+++ b/.forgejo/workflows/publish-cli-docker.yml
@@ -9,7 +9,7 @@ on:
 
 jobs:
   publish-docker:
-    runs-on: ubuntu-docker
+    runs-on: docker
 
     steps:
       - name: Checkout repository
@@ -17,35 +17,11 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Extract registry hostname
-        id: registry
-        run: echo "host=$(echo '${{ github.server_url }}' | sed 's|https\?://||')" >> "$GITHUB_OUTPUT"
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Log into container registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ steps.registry.outputs.host }}
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract Docker metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ steps.registry.outputs.host }}/${{ github.repository }}-cli
-
-      - name: Build and push Docker image
-        id: build-and-push
-        uses: docker/build-push-action@v5
+      - name: Build and publish CLI image
+        uses: http://forgejo:3000/andras/ci-actions/docker-publish@main
         with:
           context: frontend
-          file: frontend/local-client-cli/Dockerfile
-          platforms: linux/amd64
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=registry,ref=${{ steps.registry.outputs.host }}/${{ github.repository }}-cli:buildcache
-          cache-to: type=registry,ref=${{ steps.registry.outputs.host }}/${{ github.repository }}-cli:buildcache,mode=max
+          dockerfile: frontend/local-client-cli/Dockerfile
+          image-suffix: -cli
+          push: ${{ github.event_name != 'pull_request' }}
+          token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.forgejo/workflows/publish-plugin.yml b/.forgejo/workflows/publish-plugin.yml
index 25a652aa..b381ac12 100644
--- a/.forgejo/workflows/publish-plugin.yml
+++ b/.forgejo/workflows/publish-plugin.yml
@@ -9,7 +9,7 @@ env:
 
 jobs:
   publish-plugin:
-    runs-on: ubuntu-latest
+    runs-on: docker
 
     steps:
       - uses: actions/checkout@v4
@@ -28,7 +28,7 @@ jobs:
           npm run build
 
       - name: Setup Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: https://github.com/dtolnay/rust-toolchain@stable
         with:
           toolchain: "1.92.0"
           components: clippy, rustfmt
@@ -41,31 +41,15 @@ jobs:
       - name: Build Linux and Windows binaries
         run: ./scripts/build-sync-server-binaries.sh
 
-      - name: Create release
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SERVER_URL: ${{ github.server_url }}
-          REPO: ${{ github.repository }}
+      - name: Stage release assets
         run: |
-          tag="${GITHUB_REF#refs/tags/}"
-
           mkdir -p release
           cp frontend/obsidian-plugin/dist/* release/
           cp sync-server/artifacts/sync-server-* release/
 
-          # Create draft release via Forgejo API
-          RELEASE_ID=$(curl -s -X POST \
-            "${SERVER_URL}/api/v1/repos/${REPO}/releases" \
-            -H "Authorization: token ${GITHUB_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d "{\"tag_name\": \"${tag}\", \"name\": \"${tag}\", \"draft\": true}" \
-            | jq -r '.id')
-
-          # Upload release assets
-          for file in release/*; do
-            filename=$(basename "$file")
-            curl -s -X POST \
-              "${SERVER_URL}/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets?name=${filename}" \
-              -H "Authorization: token ${GITHUB_TOKEN}" \
-              -F "attachment=@${file}"
-          done
+      - name: Create draft release
+        uses: http://forgejo:3000/andras/ci-actions/forgejo-release@main
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          files: release
+          draft: "true"
diff --git a/.forgejo/workflows/publish-server-docker.yml b/.forgejo/workflows/publish-server-docker.yml
index 23852e56..d0eee343 100644
--- a/.forgejo/workflows/publish-server-docker.yml
+++ b/.forgejo/workflows/publish-server-docker.yml
@@ -9,7 +9,7 @@ on:
 
 jobs:
   publish-docker:
-    runs-on: ubuntu-docker
+    runs-on: docker
 
     steps:
       - name: Checkout repository
@@ -17,35 +17,10 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Extract registry hostname
-        id: registry
-        run: echo "host=$(echo '${{ github.server_url }}' | sed 's|https\?://||')" >> "$GITHUB_OUTPUT"
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Log into container registry
-        if: github.ref_type == 'tag'
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ steps.registry.outputs.host }}
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract Docker metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ steps.registry.outputs.host }}/${{ github.repository }}
-
-      - name: Build and push Docker image
-        id: build-and-push
-        uses: docker/build-push-action@v5
+      - name: Build and publish server image
+        uses: http://forgejo:3000/andras/ci-actions/docker-publish@main
         with:
           context: sync-server
-          platforms: linux/amd64,linux/arm64
+          # Push only on tags (matches the previous workflow's behaviour).
           push: ${{ github.ref_type == 'tag' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=registry,ref=${{ steps.registry.outputs.host }}/${{ github.repository }}:buildcache
-          cache-to: type=registry,ref=${{ steps.registry.outputs.host }}/${{ github.repository }}:buildcache,mode=max
+          token: ${{ secrets.GITHUB_TOKEN }}