diff --git a/.gitea/workflows/cd.yml b/.gitea/workflows/cd.yml
index 8e15890..fa62def 100644
--- a/.gitea/workflows/cd.yml
+++ b/.gitea/workflows/cd.yml
@@ -143,16 +143,37 @@ jobs:
 
       - name: Build and push to local registry
         run: |
+          set -euo pipefail
+          # infra#241: rootless buildah cannot build this Dockerfile in the
+          # gitea-runner pod — it drops ALL capabilities and sets
+          # allowPrivilegeEscalation:false (deliberate, it holds CI secrets), so
+          # newuidmap/newgidmap cannot remap uids and `RUN apk add` dies with
+          # "exec: no command". Every other repo on this runner has already
+          # moved: dispatch, tapir, brain-ingest-ntfy, parallax, macro-research,
+          # cobalt-dingo, agentsquad (infra#233), segment-embedder (infra#243).
+          #
+          # buildctl talks to koala's host buildkitd over the socket the runner
+          # pod already mounts, so the privileged work happens on the host and
+          # this pod's posture is irrelevant to whether the build succeeds.
+          # buildctl cannot push, so it writes an OCI archive that skopeo copies.
+          BUILDKIT_HOST="unix:///run/buildkit/buildkitd.sock"
           REGISTRY="localhost:5000"
           REF="${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.sha-tag }}"
-          buildah build \
-            --build-arg VERSION="${{ steps.meta.outputs.version }}" \
-            --label "org.opencontainers.image.revision=${{ github.sha }}" \
-            -t ${REF} \
-            -t ${REGISTRY}/${{ env.IMAGE }}:latest \
-            .
-          buildah push --tls-verify=false ${REF}
-          buildah push --tls-verify=false ${REGISTRY}/${{ env.IMAGE }}:latest
+          TAR_FILE="$(mktemp)"
+          trap 'rm -f "$TAR_FILE"' EXIT
+
+          buildctl --addr "$BUILDKIT_HOST" build \
+            --frontend dockerfile.v0 \
+            --local context=. \
+            --local dockerfile=. \
+            --opt build-arg:VERSION="${{ steps.meta.outputs.version }}" \
+            --opt label:org.opencontainers.image.revision="${{ github.sha }}" \
+            --output type=oci,dest="$TAR_FILE"
+
+          skopeo copy --dest-tls-verify=false \
+            oci-archive:"$TAR_FILE" docker://"${REF}"
+          skopeo copy --dest-tls-verify=false \
+            oci-archive:"$TAR_FILE" docker://"${REGISTRY}/${{ env.IMAGE }}:latest"
           echo "✓ Image pushed to ${REF}"
 
   deploy: