diff --git a/.gitea/workflows/cd.yml b/.gitea/workflows/cd.yml
index b73d5cc..2c9699e 100644
--- a/.gitea/workflows/cd.yml
+++ b/.gitea/workflows/cd.yml
@@ -20,6 +20,10 @@ jobs:
       - uses: actions/checkout@v4
       - id: detect
         run: |
+          # Grep the PLACEHOLDER, never the value substitution writes. A guard
+          # that greps its own substituted module path matches forever and
+          # skips every job below it -- see harg-bygglov-go#8, where that cost
+          # five weeks of empty green runs on a repo that never compiled.
           if grep -q '__MODULE_PATH__' go.mod; then
             echo "is_template=true" >> "$GITHUB_OUTPUT"
           else
@@ -65,40 +69,29 @@ jobs:
           SHA=$(git rev-parse --short HEAD)
           echo "sha-tag=${SHA}" >> "$GITHUB_OUTPUT"
 
+      # infra#309: the implementation lives in .gitea/build-image.sh, a
+      # byte-identical copy of mathias/infra's ci-templates/build-image.sh.
+      # Do not edit it here -- edit the canonical file, run `task ci:sync`,
+      # and infra's drift gate will name any repo still carrying an old copy.
+      #
+      # This matters more in a template than anywhere else: every repo
+      # generated from here inherits its CI, so a template that carries the
+      # build LOGIC manufactures a new copy of every bug in it. That is
+      # precisely how rootless buildah (infra#241) reached a dozen repos, and
+      # why the fix then had to be rediscovered here weeks later. A template
+      # that carries a CALL manufactures nothing.
+      #
+      # NEW REPOS: add yourself to mathias/infra's ci-templates/adopters.txt so
+      # the gate keeps this copy current. Until you do, the copy is unmanaged
+      # and will silently fall behind.
+      #
+      # `bash <script>` rather than executing it directly: files written via
+      # the Gitea API land 0644, and CI that depends on a file mode is a trap.
       - name: Build and push to local registry
-        run: |
-          set -e
-          # infra#241: buildctl, NOT buildah. Rootless buildah in gitea-runner's
-          # hardened securityContext cannot remap the UID/GID range
-          # newuidmap/newgidmap need on a fresh base-image pull, and the pod has
-          # no OCI runtime at all. buildctl talks to the host's buildkitd over a
-          # socket, so the privileged extraction happens on the host. Same
-          # pattern as mathias/infra's segment-embedder.yml.
-          #
-          # Highest-leverage place to fix it: every repo generated from this
-          # template inherits this CI, so a buildah-based template manufactures
-          # new instances of the bug. Warm layers mask it, so a generated repo
-          # builds fine until its first genuinely cold base-image pull.
-          BUILDKIT_HOST="unix:///run/buildkit/buildkitd.sock"
-          REGISTRY="localhost:5000"
-          REF="${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.sha-tag }}"
-          TAR_FILE="$(mktemp)"
-          trap 'rm -f "$TAR_FILE"' EXIT
-
-          buildctl --addr "$BUILDKIT_HOST" build \
-            --frontend dockerfile.v0 \
-            --local context=. \
-            --local dockerfile=. \
-            --opt label:org.opencontainers.image.revision="${{ github.sha }}" \
-            --output type=oci,dest="$TAR_FILE"
-
-          # buildctl has no registry-push equivalent to `buildah push`; skopeo
-          # copies the OCI archive up. Twice, to keep the :sha and :latest tags.
-          skopeo copy --dest-tls-verify=false \
-            oci-archive:"$TAR_FILE" docker://${REF}
-          skopeo copy --dest-tls-verify=false \
-            oci-archive:"$TAR_FILE" docker://${REGISTRY}/${{ env.IMAGE }}:latest
-          echo "✓ Image pushed to ${REF} and :latest"
+        env:
+          SHA_TAG: ${{ steps.meta.outputs.sha-tag }}
+          GIT_SHA: ${{ github.sha }}
+        run: bash .gitea/build-image.sh
 
   deploy:
     name: Deploy via GitOps