diff --git a/.gitea/workflows/build-prod.yaml b/.gitea/workflows/build-prod.yaml
index 5d2f46c..a1feba7 100644
--- a/.gitea/workflows/build-prod.yaml
+++ b/.gitea/workflows/build-prod.yaml
@@ -9,28 +9,44 @@ jobs:
     runs-on: docker
     permissions:
       packages: write
+      contents: read
+    env:
+      REGISTRY: forgejo.riotpiao.com
+      IMAGE_NAME: rock/kmsvc-manage
     steps:
-      - name: install buildx and git
-        run: apk add --no-cache docker git
+      - name: Checkout code
+        uses: actions/checkout@v4
 
-      - uses: actions/checkout@v4
+      - name: Get commit short SHA
+        id: short_sha
+        run: echo "sha=${GITHUB_SHA:0:7}" >> $GITHUB_OUTPUT
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Build and push image (commit SHA + latest)
-        run: |
-          COMMIT_SHA=${{ github.sha }}
-          SHORT_SHA=${COMMIT_SHA:0:7}
-          IMAGE_NAME="forgejo.riotpiao.com/rock/kmsvc-manage"
-          
-          docker build \
-            -t ${IMAGE_NAME}:${SHORT_SHA} \
-            -t ${IMAGE_NAME}:latest \
-            .
-          
-          # For now, tag locally. When registry auth is configured:
-          # docker push ${IMAGE_NAME}:${SHORT_SHA}
-          # docker push ${IMAGE_NAME}:latest
-          
-          echo "Built image: ${IMAGE_NAME}:${SHORT_SHA} and ${IMAGE_NAME}:latest"
+      - name: Log in to Forgejo Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels)
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=${{ steps.short_sha.outputs.sha }}
+            type=raw,value=latest,enable={{is_default_branch}}
+
+      - name: Build and push image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max