diff --git a/.forgejo/scripts/kaniko-build.sh b/.forgejo/scripts/kaniko-build.sh
new file mode 100755
index 0000000..31099d5
--- /dev/null
+++ b/.forgejo/scripts/kaniko-build.sh
@@ -0,0 +1,13 @@
+#!/busybox/sh
+set -eu
+
+mkdir -p /kaniko/.docker
+cat > /kaniko/.docker/config.json <<JSON
+{"auths":{"${REGISTRY_HOSTPORT}":{"username":"${REGISTRY_USERNAME}","password":"${REGISTRY_PASSWORD}"}}}
+JSON
+
+/kaniko/executor \
+  --context "${GITHUB_WORKSPACE}" \
+  --dockerfile "${GITHUB_WORKSPACE}/Dockerfile" \
+  --destination "${REGISTRY_HOSTPORT}/${IMAGE_NAME}:${COMMIT_SHA}" \
+  --destination "${REGISTRY_HOSTPORT}/${IMAGE_NAME}:${LATEST_TAG}"
diff --git a/.forgejo/workflows/build.yaml b/.forgejo/workflows/build.yaml
index 5b7e078..a1c2d6a 100644
--- a/.forgejo/workflows/build.yaml
+++ b/.forgejo/workflows/build.yaml
@@ -9,73 +9,22 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
-    env:
-      DOCKER_HOST: tcp://docker:2375
-      DOCKER_TLS_CERTDIR: ""
-    services:
-      docker:
-        image: docker:27-dind
-        env:
-          DOCKER_TLS_CERTDIR: ""
-        options: --privileged
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Install Docker CLI
-        run: |
-          apt-get update
-          apt-get install -y docker.io
-
-      - name: Set up Docker Buildx
-        run: |
-          export DOCKER_HOST=tcp://docker:2375
-          docker version
-          docker buildx create --use || true
-          docker buildx inspect --bootstrap
-
-      - name: Login to Registry
+      - name: Build and push
+        uses: docker://gcr.io/kaniko-project/executor:v1.23.2-debug
         env:
           REGISTRY_HOSTPORT: ${{ secrets.REGISTRY_HOSTPORT }}
           REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
           REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
-        run: |
-          set -euo pipefail
-          export DOCKER_HOST=tcp://docker:2375
-          SHA="$(git rev-parse HEAD)"
-          test -n "$REGISTRY_HOSTPORT"
-          echo "$REGISTRY_PASSWORD" | docker login "$REGISTRY_HOSTPORT" -u "$REGISTRY_USERNAME" --password-stdin
-
-      - name: Build and push
-        env:
-          REGISTRY_HOSTPORT: ${{ secrets.REGISTRY_HOSTPORT }}
-        run: |
-          set -euo pipefail
-          export DOCKER_HOST=tcp://docker:2375
-          SHA="$(git rev-parse HEAD)"
-
-          build_and_push() {
-            docker buildx build --push \
-              -f Dockerfile \
-              -t "$REGISTRY_HOSTPORT/nxtgauge-frontend-solid:${SHA}" \
-              -t "$REGISTRY_HOSTPORT/nxtgauge-frontend-solid:high-performance-latest" \
-              .
-          }
-
-          for attempt in 1 2 3; do
-            echo "Build attempt $attempt"
-            if build_and_push; then
-              exit 0
-            fi
-            echo "Build attempt $attempt failed; recreating builder and retrying"
-            docker buildx rm --all-inactive --force || true
-            docker buildx create --use || true
-            docker buildx inspect --bootstrap
-            sleep $((attempt * 10))
-          done
-
-          echo "Build failed after retries"
-          exit 1
+          IMAGE_NAME: nxtgauge-frontend-solid
+          LATEST_TAG: high-performance-latest
+          COMMIT_SHA: ${{ github.sha }}
+        with:
+          entrypoint: /busybox/sh
+          args: ${{ github.workspace }}/.forgejo/scripts/kaniko-build.sh
 
       - name: Prune old image tags (keep latest 1 SHA)
         if: success()