diff --git a/.gitea/build-image.sh b/.gitea/build-image.sh
index 61a5d7a..d912c00 100644
--- a/.gitea/build-image.sh
+++ b/.gitea/build-image.sh
@@ -32,7 +32,13 @@
 #   CONTEXT          default . -- build context directory
 #   DOCKERFILE_DIR   default $CONTEXT -- directory holding the Dockerfile
 #   DOCKERFILE_NAME  optional, when the file is not named `Dockerfile`
+#   TARGET           optional, multi-stage build target (--opt target=)
 #   BUILD_ARGS       optional, space-separated K=V pairs
+#   BUILD_SECRETS    optional, space-separated buildkit secret specs, each
+#                    `id=NAME,src=PATH`. Pass the SPEC only -- the caller
+#                    writes the secret to PATH itself. A secret VALUE must
+#                    never be passed here: it would land in this script's
+#                    argv and therefore in the CI log.
 #   EXTRA_LABELS     optional, space-separated K=V pairs
 #   GIT_SHA          optional, stamped as org.opencontainers.image.revision
 #   IMAGE_SOURCE     optional, stamped as org.opencontainers.image.source
@@ -73,6 +79,13 @@ args=(
 if [ -n "${DOCKERFILE_NAME:-}" ]; then
   args+=(--opt "filename=${DOCKERFILE_NAME}")
 fi
+if [ -n "${TARGET:-}" ]; then
+  args+=(--opt "target=${TARGET}")
+fi
+for spec in ${BUILD_SECRETS:-}; do
+  # Opaque id=NAME,src=PATH -- buildkit reads the file, nothing is echoed.
+  args+=(--secret "${spec}")
+done
 if [ -n "${GIT_SHA:-}" ]; then
   args+=(--opt "label:org.opencontainers.image.revision=${GIT_SHA}")
 fi