diff --git a/.gitea/workflows/docker-publish.yml b/.gitea/workflows/docker-publish.yml
index 46bd129..6c90fa1 100644
--- a/.gitea/workflows/docker-publish.yml
+++ b/.gitea/workflows/docker-publish.yml
@@ -19,40 +19,91 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Log in to Gitea Container Registry
+      - name: Ensure Container Build Tools (Docker CLI / Buildah)
+        run: |
+          if ! command -v docker >/dev/null 2>&1; then
+            echo "Docker CLI not found in runner image; installing static Docker CLI..."
+            curl -fsSL https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz | tar xz -C /tmp
+            mv /tmp/docker/docker /usr/local/bin/docker
+            chmod +x /usr/local/bin/docker
+            rm -rf /tmp/docker
+          fi
+          docker --version
+
+      - name: Build, Validate, and Push Image to Gitea Package Registry
         env:
           REGISTRY_USER: ${{ gitea.actor }}
           REGISTRY_TOKEN: ${{ secrets.GITEATOKEN }}
           SERVER_URL: ${{ gitea.server_url }}
-        run: |
-          REGISTRY_HOST=$(echo "${SERVER_URL}" | sed -E 's#^https?://##; s#/$##')
-          echo "Logging in to ${REGISTRY_HOST} as ${REGISTRY_USER}..."
-          echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY_HOST}" -u "${REGISTRY_USER}" --password-stdin
-
-      - name: Build, Validate, and Push Docker Image
-        env:
-          SERVER_URL: ${{ gitea.server_url }}
           REPO_NAME: ${{ gitea.repository }}
           REF_NAME: ${{ gitea.ref_name }}
           SHA: ${{ gitea.sha }}
         run: |
           REGISTRY_HOST=$(echo "${SERVER_URL}" | sed -E 's#^https?://##; s#/$##')
+          IS_HTTP=false
+          if echo "${SERVER_URL}" | grep -qE '^http://'; then
+            IS_HTTP=true
+          fi
+
           IMAGE_PATH=$(echo "${REPO_NAME}" | tr '[:upper:]' '[:lower:]')
           FULL_IMAGE="${REGISTRY_HOST}/${IMAGE_PATH}"
           SHORT_SHA=$(echo "${SHA}" | cut -c1-7)
           SAFE_REF=$(echo "${REF_NAME}" | sed -E 's#[^a-zA-Z0-9_.-]#-#g')
 
-          echo "Building image ${FULL_IMAGE}..."
-          docker build --pull \
-            -t "${FULL_IMAGE}:${SAFE_REF}" \
-            -t "${FULL_IMAGE}:${SHORT_SHA}" \
-            -t "${FULL_IMAGE}:latest" \
-            .
+          if docker info >/dev/null 2>&1; then
+            echo "Using Docker daemon via mounted socket..."
+            docker build --pull \
+              -t "${FULL_IMAGE}:${SAFE_REF}" \
+              -t "${FULL_IMAGE}:${SHORT_SHA}" \
+              -t "${FULL_IMAGE}:latest" \
+              .
 
-          echo "Validating PHP syntax inside built container..."
-          docker run --rm "${FULL_IMAGE}:${SHORT_SHA}" sh -c 'find /var/www/html -name "*.php" -exec php -l {} +'
+            echo "Validating PHP syntax inside built container..."
+            docker run --rm "${FULL_IMAGE}:${SHORT_SHA}" sh -c 'find /var/www/html -name "*.php" -exec php -l {} +'
 
-          echo "Pushing tags to Gitea Package Registry..."
-          docker push "${FULL_IMAGE}:${SAFE_REF}"
-          docker push "${FULL_IMAGE}:${SHORT_SHA}"
-          docker push "${FULL_IMAGE}:latest"
+            echo "Attempting Docker login to ${REGISTRY_HOST}..."
+            if echo "${REGISTRY_TOKEN}" | docker login "${SERVER_URL}" -u "${REGISTRY_USER}" --password-stdin 2>/dev/null \
+               || echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY_HOST}" -u "${REGISTRY_USER}" --password-stdin 2>/dev/null; then
+              echo "Pushing tags via Docker CLI..."
+              docker push "${FULL_IMAGE}:${SAFE_REF}"
+              docker push "${FULL_IMAGE}:${SHORT_SHA}"
+              docker push "${FULL_IMAGE}:latest"
+            else
+              echo "Docker daemon rejected login (likely plain HTTP registry ${SERVER_URL} not in host insecure-registries)."
+              echo "Using skopeo to push image directly from Docker daemon with TLS verification disabled..."
+              if ! command -v skopeo >/dev/null 2>&1; then
+                apt-get update && apt-get install -y skopeo
+              fi
+              TLS_FLAG="--dest-tls-verify=true"
+              if [ "${IS_HTTP}" = "true" ]; then
+                TLS_FLAG="--dest-tls-verify=false"
+              fi
+              for TAG in "${SAFE_REF}" "${SHORT_SHA}" "latest"; do
+                skopeo copy ${TLS_FLAG} \
+                  --dest-creds "${REGISTRY_USER}:${REGISTRY_TOKEN}" \
+                  "docker-daemon:${FULL_IMAGE}:${TAG}" \
+                  "docker://${FULL_IMAGE}:${TAG}"
+              done
+            fi
+          else
+            echo "Docker socket (/var/run/docker.sock) is not mounted in this runner container."
+            echo "Falling back to daemonless Buildah..."
+            if ! command -v buildah >/dev/null 2>&1; then
+              apt-get update && apt-get install -y buildah
+            fi
+            TLS_FLAG="--tls-verify=true"
+            if [ "${IS_HTTP}" = "true" ]; then
+              TLS_FLAG="--tls-verify=false"
+            fi
+            buildah bud --storage-driver=vfs --isolation=chroot --pull \
+              -t "${FULL_IMAGE}:${SAFE_REF}" \
+              -t "${FULL_IMAGE}:${SHORT_SHA}" \
+              -t "${FULL_IMAGE}:latest" \
+              .
+            for TAG in "${SAFE_REF}" "${SHORT_SHA}" "latest"; do
+              buildah push --storage-driver=vfs ${TLS_FLAG} \
+                --creds "${REGISTRY_USER}:${REGISTRY_TOKEN}" \
+                "${FULL_IMAGE}:${TAG}" \
+                "docker://${FULL_IMAGE}:${TAG}"
+            done
+          fi