diff --git a/.forgejo/workflows/build.yaml b/.forgejo/workflows/build.yaml
index 0a7cd61..5f9145f 100644
--- a/.forgejo/workflows/build.yaml
+++ b/.forgejo/workflows/build.yaml
@@ -140,7 +140,10 @@ jobs:
               -t "$image_ref" \
               .
 
-            digest="$(grep -o '"containerimage.digest":"sha256:[^"]*"' "$metadata_file" | cut -d'"' -f4)"
+            # buildx writes the metadata file pretty-printed (space after the
+            # colon), which the old compact-JSON-only pattern never matched -
+            # tolerate optional whitespace and extract the digest directly.
+            digest="$(grep -o '"containerimage\.digest"[[:space:]]*:[[:space:]]*"sha256:[^"]*"' "$metadata_file" | grep -o 'sha256:[^"]*')"
             if [ -z "$digest" ]; then
               echo "Failed to determine digest for $service" >&2
               exit 1