diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index 1a839a5..43194f6 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -78,55 +78,58 @@ jobs:
           fi
 
   build-and-push:
-    name: Build and publish Docker image
+    name: Build and publish Factorio image
     needs: check-version
-
     if: needs.check-version.outputs.should_build == 'true'
-
-    runs-on: prunner-ubuntu
+    runs-on: ubuntu-latest
 
     steps:
-      - name: Install CA
-        run: |
-          curl -fsSL http://info.noko.tan/install.sh | sudo bash -s -- nokotan_ca.crt
-      - name: Checkout repository
+      - name: Checkout
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - name: Create BuildKit config
+          token: ${{ secrets.GITEA_TOKEN }}
+
+      - name: Login to Nexspence Registry
+        shell: bash
         run: |
-          cat > /tmp/buildkitd.toml <<'EOF'
-          [registry."docker.io"]
-            mirrors = ["mirror.gcr.io"]
-          EOF
-      - name: Log in to Nexus Docker Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.NEXUS_REGISTRY }}
-          username: ${{ secrets.NEXUS_USERNAME }}
-          password: ${{ secrets.NEXUS_TOKEN }}
+          set -euo pipefail
 
-      - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@v3
-        with:
-          driver-opts: |
-            image=moby/buildkit:buildx-stable-1
-          buildkitd-config-inline: |
-            [registry."docker.io"]
-              mirrors = ["mirror.gcr.io"]
+          echo "${{ secrets.NEXSPENCE_PASSWORD }}" | docker login \
+            images.docker.noko.tan \
+            --username "${{ secrets.NEXSPENCE_USERNAME }}" \
+            --password-stdin
 
-      - name: Build and push Factorio image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./Dockerfile
-          push: true
-          build-args: |
-            FACTORIO_VERSION=${{ needs.check-version.outputs.version }}
-          tags: |
-            ${{ env.IMAGE_NAME }}:${{ needs.check-version.outputs.version }}
-            ${{ env.IMAGE_NAME }}:latest
+      - name: Build Factorio Docker image
+        shell: bash
+        env:
+          FACTORIO_VERSION: ${{ needs.check-version.outputs.version }}
+        run: |
+          set -euo pipefail
 
+          IMAGE="images.docker.noko.tan/frieren/factorio"
+          SHA_TAG="${{ gitea.sha }}"
+
+          docker build \
+            --build-arg "FACTORIO_VERSION=${FACTORIO_VERSION}" \
+            -t "${IMAGE}:latest" \
+            -t "${IMAGE}:${FACTORIO_VERSION}" \
+            -t "${IMAGE}:${SHA_TAG}" \
+            .
+
+      - name: Push Factorio Docker image
+        shell: bash
+        env:
+          FACTORIO_VERSION: ${{ needs.check-version.outputs.version }}
+        run: |
+          set -euo pipefail
+
+          IMAGE="images.docker.noko.tan/frieren/factorio"
+          SHA_TAG="${{ gitea.sha }}"
+
+          docker push "${IMAGE}:latest"
+          docker push "${IMAGE}:${FACTORIO_VERSION}"
+          docker push "${IMAGE}:${SHA_TAG}"
       - name: Create Git tag
         shell: bash
         env:
@@ -139,7 +142,18 @@ jobs:
           git config user.name "gitea-actions[bot]"
           git config user.email "gitea-actions[bot]@localhost"
 
-          git tag -a "$TAG" \
-            -m "Build Factorio ${VERSION}"
+          if git ls-remote --exit-code --tags origin "refs/tags/${TAG}" >/dev/null 2>&1; then
+            echo "Tag ${TAG} already exists"
+            exit 0
+          fi
+
+          git tag -a "${TAG}" -m "Build Factorio ${VERSION}"
+          git push origin "${TAG}"
+
+
+      - name: Logout from Nexspence
+        if: always()
+        shell: bash
+        run: |
+          docker logout images.docker.noko.tan
 
-          git push origin "$TAG"