diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index ab743cb..ab72fc2 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -1,4 +1,4 @@
-name: build-and-push
+name: Build Backend And Update GitOps
 
 on:
   push:
@@ -7,267 +7,78 @@ on:
       - high-performance
 
 jobs:
-  detect-changes:
-    runs-on: ubuntu-latest
-    outputs:
-      services_csv: ${{ steps.detect.outputs.services_csv }}
-      has_changes: ${{ steps.detect.outputs.has_changes }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Detect changed services
-        id: detect
-        run: |
-          set -euo pipefail
-
-          set_output() {
-            local key="$1"
-            local value="$2"
-            if [ -n "${GITHUB_OUTPUT:-}" ]; then
-              echo "$key=$value" >> "$GITHUB_OUTPUT"
-            fi
-            echo "::set-output name=$key::$value"
-          }
-
-          if git rev-parse --verify HEAD^ >/dev/null 2>&1; then
-            CHANGED_FILES=$(git diff --name-only HEAD^ HEAD)
-          else
-            CHANGED_FILES=$(git ls-files)
-          fi
-
-          LAST_COMMIT_MSG=$(git log -1 --pretty=%B | tr '\n' ' ')
-
-          echo "Changed files:"
-          echo "$CHANGED_FILES"
-
-          ALL_SERVICES='gateway,users,companies,jobs,leads,job-seekers,customers,payments,employees,photographers,makeup-artists,tutors,developers,video-editors,graphic-designers,social-media-managers,fitness-trainers,catering-services,ugc-content-creators,cron'
-
-          # Force full build for explicit trigger commits.
-          if echo "$LAST_COMMIT_MSG" | grep -Eiq 'trigger gitea pipeline|force build|rebuild all'; then
-            set_output "services_csv" "$ALL_SERVICES"
-            set_output "has_changes" "true"
-            exit 0
-          fi
-
-          # Build everything for workflow/docker/shared backend changes.
-          if echo "$CHANGED_FILES" | grep -Eq '^(\.gitea/workflows/|Dockerfile|Dockerfile\.|Cargo\.toml|Cargo\.lock|crates/|scripts/)'; then
-            set_output "services_csv" "$ALL_SERVICES"
-            set_output "has_changes" "true"
-            exit 0
-          fi
-
-          SERVICES=''
-          add_service() {
-            local svc="$1"
-            case ",${SERVICES}," in
-              *",${svc},"*) ;;
-              *)
-                if [ -z "$SERVICES" ]; then
-                  SERVICES="$svc"
-                else
-                  SERVICES="$SERVICES,$svc"
-                fi
-                ;;
-            esac
-          }
-
-          while IFS= read -r f; do
-            case "$f" in
-              apps/gateway/*) add_service "gateway" ;;
-              apps/users/*) add_service "users" ;;
-              apps/companies/*) add_service "companies" ;;
-              apps/jobs/*) add_service "jobs" ;;
-              apps/leads/*) add_service "leads" ;;
-              apps/job_seekers/*) add_service "job-seekers" ;;
-              apps/customers/*) add_service "customers" ;;
-              apps/payments/*) add_service "payments" ;;
-              apps/employees/*) add_service "employees" ;;
-              apps/photographers/*) add_service "photographers" ;;
-              apps/makeup_artists/*) add_service "makeup-artists" ;;
-              apps/tutors/*) add_service "tutors" ;;
-              apps/developers/*) add_service "developers" ;;
-              apps/video_editors/*) add_service "video-editors" ;;
-              apps/graphic_designers/*) add_service "graphic-designers" ;;
-              apps/social_media_managers/*) add_service "social-media-managers" ;;
-              apps/fitness_trainers/*) add_service "fitness-trainers" ;;
-              apps/catering_services/*) add_service "catering-services" ;;
-              apps/ugc_content_creators/*) add_service "ugc-content-creators" ;;
-              apps/cron/*) add_service "cron" ;;
-            esac
-          done <<< "$CHANGED_FILES"
-
-          if [ -z "$SERVICES" ]; then
-            set_output "services_csv" ""
-            set_output "has_changes" "false"
-          else
-            set_output "services_csv" "$SERVICES"
-            set_output "has_changes" "true"
-          fi
-
-  build:
-    needs: detect-changes
-    if: needs.detect-changes.outputs.has_changes == 'true'
+  build-and-update:
     runs-on: ubuntu-latest
     env:
       DOCKER_HOST: unix:///var/run/docker.sock
-    strategy:
-      fail-fast: false
-      matrix:
-        service:
-          - gateway
-          - users
-          - companies
-          - jobs
-          - leads
-          - job-seekers
-          - customers
-          - payments
-          - employees
-          - photographers
-          - makeup-artists
-          - tutors
-          - developers
-          - video-editors
-          - graphic-designers
-          - social-media-managers
-          - fitness-trainers
-          - catering-services
-          - ugc-content-creators
-          - cron
+      GITOPS_USERNAME: ${{ secrets.GITOPS_GITHUB_USERNAME || 'Traceworks2023' }}
+      GITOPS_PASSWORD: ${{ secrets.GITOPS_GITHUB_TOKEN || secrets.GITOPS_PAT }}
+      GITOPS_REPO: https://github.com/Traceworks2023/nxtgauge-gitops.git
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Set up Docker Buildx
+      - name: Install Docker CLI
         run: |
-          export DOCKER_HOST=unix:///var/run/docker.sock
-          docker version
-          docker buildx create --use || true
-          docker buildx inspect --bootstrap
+          apt-get update
+          apt-get install -y docker.io git python3
 
-      - name: Login to Registry
-        env:
-          REGISTRY_HOSTPORT: ${{ secrets.REGISTRY_HOSTPORT }}
-          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
-          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+      - name: Log in to registry
+        run: |
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login ci.nxtgauge.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+
+      - name: Build, push, and update GitOps
         run: |
           set -euo pipefail
-          export DOCKER_HOST=unix:///var/run/docker.sock
-          test -n "$REGISTRY_HOSTPORT"
+          test -n "${GITOPS_PASSWORD:-}" || { echo "GITOPS_PASSWORD is empty"; exit 1; }
+          AUTH="$(printf '%s' "${GITOPS_USERNAME}:${GITOPS_PASSWORD}" | base64 -w0)"
+          TMP_DIR="$(mktemp -d)"
+          git -c http.extraHeader="AUTHORIZATION: basic ${AUTH}" clone --branch main "${GITOPS_REPO}" "${TMP_DIR}"
+          while IFS='|' read -r service app_dir; do
+            [ -n "${service}" ] || continue
+            IMAGE="ci.nxtgauge.com/ashwin/nxtgauge-rust-${service}:${{ github.sha }}"
+            docker build -f "${app_dir}/Dockerfile" -t "${IMAGE}" .
+            docker push "${IMAGE}"
+            IMAGE_DIGEST="$(docker image inspect "${IMAGE}" --format '{{join .RepoDigests "\n"}}' | grep '@sha256:' | sed -n '1s|.*@||p')"
+            test -n "${IMAGE_DIGEST}" || { echo "failed to resolve image digest for ${IMAGE}"; exit 1; }
+            (
+              cd "${TMP_DIR}"
+              ./scripts/set-backend-rust-release.sh "${service}" "${IMAGE_DIGEST}"
+            )
+          done <<'SERVICES'
+          catering-services|apps/catering_services
+          companies|apps/companies
+          cron|apps/cron
+          customers|apps/customers
+          developers|apps/developers
+          employees|apps/employees
+          fitness-trainers|apps/fitness_trainers
+          gateway|apps/gateway
+          graphic-designers|apps/graphic_designers
+          job-seekers|apps/job_seekers
+          jobs|apps/jobs
+          leads|apps/leads
+          makeup-artists|apps/makeup_artists
+          payments|apps/payments
+          photographers|apps/photographers
+          social-media-managers|apps/social_media_managers
+          tutors|apps/tutors
+          ugc-content-creators|apps/ugc_content_creators
+          users|apps/users
+          video-editors|apps/video_editors
+SERVICES
+          cd "${TMP_DIR}"
+          git config user.name "forgejo-actions"
+          git config user.email "forgejo-actions@nxtgauge.com"
+          git add apps/nxtgauge-backend-rust/overlays/prod/backend-release-state.tsv apps/nxtgauge-backend-rust/overlays/prod/release-patches.yaml apps/nxtgauge-backend-rust/overlays/prod/disabled-deployments.yaml
+          git diff --cached --quiet && exit 0
+          git commit -m "chore(gitops): deploy backend@${{ github.sha }}"
           for attempt in 1 2 3 4 5; do
-            echo "Registry login attempt $attempt to $REGISTRY_HOSTPORT"
-            if echo "$REGISTRY_PASSWORD" | docker login "$REGISTRY_HOSTPORT" -u "$REGISTRY_USERNAME" --password-stdin; then
+            git -c http.extraHeader="AUTHORIZATION: basic ${AUTH}" pull --rebase origin main
+            if git -c http.extraHeader="AUTHORIZATION: basic ${AUTH}" push origin main; then
               exit 0
             fi
-            echo "Registry login failed (attempt $attempt); retrying..."
-            sleep $((attempt * 8))
+            sleep "$attempt"
           done
-
-          echo "Registry login failed after retries"
+          echo "failed to push GitOps update after retries"
           exit 1
-
-      - name: Build and push
-        env:
-          REGISTRY_HOSTPORT: ${{ secrets.REGISTRY_HOSTPORT }}
-          SERVICES_CSV: ${{ needs.detect-changes.outputs.services_csv }}
-        run: |
-          set -euo pipefail
-          export DOCKER_HOST=unix:///var/run/docker.sock
-          if [ -n "$SERVICES_CSV" ] && ! echo ",$SERVICES_CSV," | grep -q ",${{ matrix.service }},"; then
-            echo "Skipping unchanged service: ${{ matrix.service }}"
-            exit 0
-          fi
-
-          build_with_cache() {
-            docker buildx build --push \
-              -f Dockerfile.simple \
-              --build-arg SERVICE_NAME=${{ matrix.service }} \
-              --cache-from type=registry,ref=$REGISTRY_HOSTPORT/nxtgauge-rust-${{ matrix.service }}:buildcache \
-              --cache-to type=registry,ref=$REGISTRY_HOSTPORT/nxtgauge-rust-${{ matrix.service }}:buildcache,mode=max \
-              -t "$REGISTRY_HOSTPORT/nxtgauge-rust-${{ matrix.service }}:${{ gitea.sha }}" \
-              -t "$REGISTRY_HOSTPORT/nxtgauge-rust-${{ matrix.service }}:high-performance-latest" \
-              .
-          }
-
-          build_without_cache_export() {
-            docker buildx build --push \
-              -f Dockerfile.simple \
-              --build-arg SERVICE_NAME=${{ matrix.service }} \
-              --cache-from type=registry,ref=$REGISTRY_HOSTPORT/nxtgauge-rust-${{ matrix.service }}:buildcache \
-              -t "$REGISTRY_HOSTPORT/nxtgauge-rust-${{ matrix.service }}:${{ gitea.sha }}" \
-              -t "$REGISTRY_HOSTPORT/nxtgauge-rust-${{ matrix.service }}:high-performance-latest" \
-              .
-          }
-
-          for attempt in 1 2 3; do
-            echo "Build attempt $attempt with cache export for ${{ matrix.service }}"
-            if build_with_cache; then
-              exit 0
-            fi
-            echo "Attempt $attempt failed; retrying after backoff"
-            sleep $((attempt * 10))
-          done
-
-          echo "Falling back to build without cache export for ${{ matrix.service }}"
-          if ! build_without_cache_export; then
-            echo "Final fallback: push tags without cache"
-            docker buildx build --push \
-              -f Dockerfile.simple \
-              --build-arg SERVICE_NAME=${{ matrix.service }} \
-              -t "$REGISTRY_HOSTPORT/nxtgauge-rust-${{ matrix.service }}:${{ gitea.sha }}" \
-              -t "$REGISTRY_HOSTPORT/nxtgauge-rust-${{ matrix.service }}:high-performance-latest" \
-              .
-          fi
-
-      - name: Prune old image tags (keep latest 1 SHA)
-        if: success()
-        continue-on-error: true
-        env:
-          REGISTRY_HOST: ${{ secrets.REGISTRY_HOSTPORT }}
-          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
-          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
-        run: |
-          set -euo pipefail
-          python3 .gitea/scripts/registry_prune.py \
-            --registry "$REGISTRY_HOST" \
-            --repo "nxtgauge-rust-${{ matrix.service }}" \
-            --username "$REGISTRY_USERNAME" \
-            --password "$REGISTRY_PASSWORD" \
-            --keep 1
-
-      - name: Update GitOps and trigger deployment
-        if: always()
-        continue-on-error: true
-        env:
-          GITEOPS_REPO: ${{ secrets.GITEOPS_REPO }}
-          GITEOPS_SSH_KEY: ${{ secrets.GITEOPS_SSH_KEY }}
-        run: |
-          set -euo pipefail
-
-          if [ -z "$GITEOPS_REPO" ]; then
-            echo "GITEOPS_REPO secret not set, skipping GitOps update"
-            exit 0
-          fi
-
-          # Clone gitops repo
-          GITEOPS_DIR=$(mktemp -d)
-          git clone "$GITEOPS_REPO" "$GITEOPS_DIR"
-          cd "$GITEOPS_DIR"
-
-          # Set up SSH key for push
-          mkdir -p ~/.ssh
-          echo "$GITEOPS_SSH_KEY" > ~/.ssh/id_ed25519
-          chmod 600 ~/.ssh/id_ed25519
-          ssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/null
-
-          # Update gitops with new SHA
-          python3 .gitea/scripts/update-gitops.py \
-            --repo "$GITEOPS_DIR" \
-            --service "${{ matrix.service }}" \
-            --sha "${{ gitea.sha }}" \
-            --message "chore: deploy ${{ matrix.service }}@${{ gitea.sha }}"
-
-          rm -rf "$GITEOPS_DIR"