diff --git a/.gitea/workflows/cd.yml b/.gitea/workflows/cd.yml
index 0c3cdae..f92e437 100644
--- a/.gitea/workflows/cd.yml
+++ b/.gitea/workflows/cd.yml
@@ -38,7 +38,7 @@ jobs:
     # __PROJECT_NAME__/__MODULE_PATH__ are placeholders substituted only when
     # a repo is generated from this template -- on the raw template repo
     # itself they're still literal, and `IMAGE: __PROJECT_NAME__` contains
-    # uppercase letters, which buildah/Docker rejects outright ("repository
+    # uppercase letters, which the registry rejects outright ("repository
     # name must be lowercase"). Build/deploy can never succeed here; skip
     # them on this repo so its own CI reads green on what it can actually
     # validate (the check job).
@@ -54,41 +54,29 @@ jobs:
           SHA=$(git rev-parse --short HEAD)
           echo "sha-tag=${SHA}" >> "$GITHUB_OUTPUT"
 
-      # infra#241: buildctl, NOT buildah. Rootless buildah in gitea-runner's
-      # hardened securityContext (capabilities: drop [ALL],
-      # allowPrivilegeEscalation: false) cannot remap the UID/GID range
-      # newuidmap/newgidmap need on a fresh base-image pull, and it has no OCI
-      # runtime at all. buildctl talks to the host's buildkitd over a socket, so
-      # the privileged extraction happens in buildkitd on the host and never in
-      # this pod. Same pattern as mathias/infra's segment-embedder.yml.
+      # infra#309: the implementation lives in .gitea/build-image.sh, a
+      # byte-identical copy of mathias/infra's ci-templates/build-image.sh.
+      # Do not edit it here -- edit the canonical file, run `task ci:sync`,
+      # and infra's drift gate will name any repo still carrying an old copy.
       #
-      # This matters MORE in a template than anywhere else: every repo generated
-      # from here inherits its CI, so a buildah-based template manufactures new
-      # instances of a bug that has already cost this estate several red builds.
+      # This matters more in a template than anywhere else: every repo
+      # generated from here inherits its CI, so a template that carries the
+      # build LOGIC manufactures a new copy of every bug in it. That is
+      # precisely how rootless buildah (infra#241) reached a dozen repos, and
+      # why the fix then had to be rediscovered here weeks later. A template
+      # that carries a CALL manufactures nothing.
+      #
+      # NEW REPOS: add yourself to mathias/infra's ci-templates/adopters.txt so
+      # the gate keeps this copy current. Until you do, the copy is unmanaged
+      # and will silently fall behind.
+      #
+      # `bash <script>` rather than executing it directly: files written via
+      # the Gitea API land 0644, and CI that depends on a file mode is a trap.
       - name: Build and push to local registry
-        run: |
-          set -e
-          BUILDKIT_HOST="unix:///run/buildkit/buildkitd.sock"
-          REGISTRY="localhost:5000"
-          REF="${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.sha-tag }}"
-          TAR_FILE="$(mktemp)"
-          trap 'rm -f "$TAR_FILE"' EXIT
-
-          buildctl --addr "$BUILDKIT_HOST" build \
-            --frontend dockerfile.v0 \
-            --local context=. \
-            --local dockerfile=. \
-            --opt label:org.opencontainers.image.revision="${{ github.sha }}" \
-            --output type=oci,dest="$TAR_FILE"
-
-          # buildctl has no registry-push equivalent to `buildah push`; skopeo
-          # copies the OCI archive up. Two copies because the buildah version
-          # tagged both :sha and :latest.
-          skopeo copy --dest-tls-verify=false \
-            oci-archive:"$TAR_FILE" docker://${REF}
-          skopeo copy --dest-tls-verify=false \
-            oci-archive:"$TAR_FILE" docker://${REGISTRY}/${{ env.IMAGE }}:latest
-          echo "✓ Image pushed to ${REF} and :latest"
+        env:
+          SHA_TAG: ${{ steps.meta.outputs.sha-tag }}
+          GIT_SHA: ${{ github.sha }}
+        run: bash .gitea/build-image.sh
 
   deploy:
     name: Deploy via GitOps