diff --git a/.gitea/workflows/build-and-deploy.yml b/.gitea/workflows/build-and-deploy.yml
index 54efbb1..f9a1178 100644
--- a/.gitea/workflows/build-and-deploy.yml
+++ b/.gitea/workflows/build-and-deploy.yml
@@ -5,6 +5,10 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   build:
     runs-on: builder
@@ -19,11 +23,10 @@ jobs:
         run: |
           set -euo pipefail
           for attempt in 1 2 3; do
-            if docker buildx build --push --provenance=false --tag "$IMAGE_SHA" --tag "$IMAGE_LATEST" .; then
-              published_images="$(docker image ls --format '{{.Repository}}:{{.Tag}}' | awk -v sha="$IMAGE_SHA" -v latest="$IMAGE_LATEST" '$0 == sha || $0 == latest')"
-              if [ -n "$published_images" ]; then
-                docker image rm -f $published_images
-              fi
+            if docker build --tag "$IMAGE_SHA" --tag "$IMAGE_LATEST" . &&
+              docker push "$IMAGE_SHA" &&
+              docker push "$IMAGE_LATEST"; then
+              docker image rm -f "$IMAGE_SHA" "$IMAGE_LATEST"
               exit 0
             fi
             sleep "$((attempt * 10))"