diff --git a/.gitea/workflows/build-and-deploy.yml b/.gitea/workflows/build-and-deploy.yml
index efdc3ea..1799efb 100644
--- a/.gitea/workflows/build-and-deploy.yml
+++ b/.gitea/workflows/build-and-deploy.yml
@@ -5,6 +5,10 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   build:
     runs-on: builder
@@ -19,20 +23,17 @@ jobs:
         run: |
           set -euo pipefail
           for attempt in 1 2 3; do
-            if docker buildx build \
-              --push \
-              --provenance=false \
+            if docker build \
               --tag "$IMAGE_SHA" \
               --tag "$IMAGE_LATEST" \
               --build-arg MAPBOX_ACCESS_TOKEN="${{ secrets.MAPBOX_ACCESS_TOKEN }}" \
               --build-arg MAPBOX_STYLE="mapbox/streets-v12" \
               --build-arg TELEGRAM_BOT_USERNAME="carfteebot" \
               --build-arg BUILD_VERSION="${GITHUB_SHA}" \
-              .; then
-              published_images="$(docker image ls --format '{{.Repository}}:{{.Tag}}' | awk -v sha="$IMAGE_SHA" -v latest="$IMAGE_LATEST" '$0 == sha || $0 == latest')"
-              if [ -n "$published_images" ]; then
-                docker image rm -f $published_images
-              fi
+              . &&
+              docker push "$IMAGE_SHA" &&
+              docker push "$IMAGE_LATEST"; then
+              docker image rm -f "$IMAGE_SHA" "$IMAGE_LATEST"
               exit 0
             fi
             sleep "$((attempt * 10))"