diff --git a/.gitea/workflows/docker-publish.yml b/.gitea/workflows/docker-publish.yml
index fff97ed..ea99f15 100644
--- a/.gitea/workflows/docker-publish.yml
+++ b/.gitea/workflows/docker-publish.yml
@@ -10,7 +10,6 @@ on:
       - 'v*'
   workflow_dispatch:
 
-
 jobs:
   build-and-push:
     name: Build & Push to Gitea Package Registry
@@ -70,8 +69,8 @@ jobs:
               docker push "${FULL_IMAGE}:${SHORT_SHA}"
               docker push "${FULL_IMAGE}:latest"
             else
-              echo "Docker daemon rejected login (likely plain HTTP registry ${SERVER_URL} not in host insecure-registries)."
-              echo "Using skopeo to push image directly from Docker daemon with TLS verification disabled..."
+              echo "Docker daemon rejected login (plain HTTP registry ${SERVER_URL} not in host insecure-registries)."
+              echo "Exporting built image with Docker CLI and pushing via skopeo..."
               if ! command -v skopeo >/dev/null 2>&1; then
                 apt-get update && apt-get install -y skopeo
               fi
@@ -79,12 +78,15 @@ jobs:
               if [ "${IS_HTTP}" = "true" ]; then
                 TLS_FLAG="--dest-tls-verify=false"
               fi
+              docker save "${FULL_IMAGE}:${SHORT_SHA}" -o /tmp/image.tar
               for TAG in "${SAFE_REF}" "${SHORT_SHA}" "latest"; do
+                echo "Pushing ${FULL_IMAGE}:${TAG}..."
                 skopeo copy ${TLS_FLAG} \
                   --dest-creds "${REGISTRY_USER}:${REGISTRY_TOKEN}" \
-                  "docker-daemon:${FULL_IMAGE}:${TAG}" \
+                  "docker-archive:/tmp/image.tar" \
                   "docker://${FULL_IMAGE}:${TAG}"
               done
+              rm -f /tmp/image.tar
             fi
           else
             echo "Docker socket (/var/run/docker.sock) is not mounted in this runner container."