diff --git a/.forgejo/workflows/build.yaml b/.forgejo/workflows/build.yaml
new file mode 100644
index 0000000..d0fa067
--- /dev/null
+++ b/.forgejo/workflows/build.yaml
@@ -0,0 +1,57 @@
+# Forgejo Actions build — push image on main only.
+# Tag is commit short SHA: unique, immutable, maps to exactly one commit.
+# No write-back, no git push — ArgoCD Image Updater pulls new builds autonomously.
+# Enabled by Stage 1 (B, C1).
+name: Build
+
+on:
+  push:
+    branches: [main]
+
+env:
+  REGISTRY: forgejo.riotpiao.com
+  IMAGE: forgejo.riotpiao.com/rock/api-gateway
+
+jobs:
+  build:
+    name: Build and push image
+    runs-on: docker
+    container:
+      image: docker:27-cli
+      # The runner's dind sidecar shares the pod network and the mTLS cert
+      # emptyDir, so the daemon is reachable on localhost with the client certs
+      # dind generated at startup.
+      options: --network host
+    env:
+      DOCKER_HOST: tcp://localhost:2376
+      DOCKER_TLS_VERIFY: "1"
+      DOCKER_CERT_PATH: /docker-certs/client
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Get short SHA
+        id: sha
+        run: |
+          SHORT_SHA=$(git rev-parse --short HEAD)
+          echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
+
+      - name: Registry login
+        run: |
+          echo "${FORGEJO_PAT}" | docker login "${REGISTRY}" \
+            --username rock --password-stdin
+        env:
+          FORGEJO_PAT: ${{ secrets.FORGEJO_RIOTPIAO_PAT }}
+
+      - name: Build
+        run: |
+          docker build \
+            --build-arg "VERSION=${{ steps.sha.outputs.short_sha }}" \
+            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
+            .
+
+      - name: Push
+        run: docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
+
+      - name: Report digest
+        run: |
+          docker inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
diff --git a/.forgejo/workflows/ci.yaml b/.forgejo/workflows/ci.yaml
index f5a4d18..180d6e4 100644
--- a/.forgejo/workflows/ci.yaml
+++ b/.forgejo/workflows/ci.yaml
@@ -1,9 +1,7 @@
-# Forgejo Actions CI. Note the path: Forgejo reads .forgejo/workflows/, not
-# .github/workflows/. The remote for this repo is git.riotpiao.com, so a GitHub
-# workflow here would never run.
-#
-# runs-on: docker matches the only label the cluster runner declares
-# (talos-runner, labels: [docker]).
+# Forgejo Actions CI — verification only (vet, test, build).
+# Build and push happens in build.yaml on main push.
+# Note: Forgejo reads .forgejo/workflows/, not .github/workflows/.
+# runs-on: docker matches the only label the cluster runner declares.
 name: CI
 
 on:
@@ -12,10 +10,6 @@ on:
   pull_request:
     branches: [main]
 
-env:
-  REGISTRY: forgejo.riotpiao.com
-  IMAGE: forgejo.riotpiao.com/rock/api-gateway
-
 jobs:
   verify:
     name: Test, vet, build
@@ -40,46 +34,3 @@ jobs:
           go install golang.org/x/vuln/cmd/govulncheck@latest
           govulncheck ./...
         continue-on-error: true
-
-  image:
-    name: Build and push image
-    runs-on: docker
-    needs: verify
-    # Only publish from main. PRs get the verify job and nothing else, so an
-    # untrusted branch can never push a tag the cluster might pull.
-    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
-    container:
-      image: docker:27-cli
-      # The runner's dind sidecar shares the pod network and the mTLS cert
-      # emptyDir, so the daemon is reachable on localhost with the client certs
-      # dind generated at startup.
-      options: --network host
-    env:
-      DOCKER_HOST: tcp://localhost:2376
-      DOCKER_TLS_VERIFY: "1"
-      DOCKER_CERT_PATH: /docker-certs/client
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Registry login
-        run: |
-          echo "${FORGEJO_PAT}" | docker login "${REGISTRY}" \
-            --username rock --password-stdin
-        env:
-          FORGEJO_PAT: ${{ secrets.FORGEJO_RIOTPIAO_PAT }}
-
-      # SHA tags only. 6.1 requires them, and :latest makes an Argo rollout
-      # non-deterministic — the same tag can resolve to different bits.
-      - name: Build
-        run: |
-          docker build \
-            --build-arg "VERSION=${GITHUB_SHA}" \
-            -t "${IMAGE}:${GITHUB_SHA}" \
-            .
-
-      - name: Push
-        run: docker push "${IMAGE}:${GITHUB_SHA}"
-
-      - name: Report digest
-        run: |
-          docker inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${GITHUB_SHA}"