diff --git a/.gitea/workflows/docker.yml b/.gitea/workflows/docker.yml
index 3db4eba..7ce4fe2 100644
--- a/.gitea/workflows/docker.yml
+++ b/.gitea/workflows/docker.yml
@@ -8,6 +8,7 @@ on:
 
 permissions:
   contents: read
+  packages: write
 
 jobs:
   build-and-publish:
@@ -16,30 +17,34 @@ jobs:
       - name: Check out source
         uses: actions/checkout@v4
 
-      - name: Log in to Docker Hub
+      - name: Log in to Gitea Container Registry
         env:
-          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
-          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+          REGISTRY_USERNAME: ${{ gitea.actor }}
+          REGISTRY_TOKEN: ${{ secrets.GITEA_TOKEN }}
         run: |
-          printf '%s' "$DOCKERHUB_TOKEN" |
-            docker login --username "$DOCKERHUB_USERNAME" --password-stdin
+          printf '%s' "$REGISTRY_TOKEN" |
+            docker login git.anchorhost.eu --username "$REGISTRY_USERNAME" --password-stdin
 
       - name: Build and tag image
         env:
           COMMIT_SHA: ${{ gitea.sha }}
-          DOCKER_IMAGE: ${{ secrets.DOCKER_IMAGE }}
+          DOCKER_IMAGE: git.anchorhost.eu/anchorhost.eu/anchorhost-frontend
         run: |
           docker build \
             --label "org.opencontainers.image.revision=$COMMIT_SHA" \
             --tag "$DOCKER_IMAGE:frontend" \
+            --tag "$DOCKER_IMAGE:main-${COMMIT_SHA:0:12}" \
             .
 
       - name: Push image
         env:
-          DOCKER_IMAGE: ${{ secrets.DOCKER_IMAGE }}
-        run: docker push "$DOCKER_IMAGE:frontend"
+          COMMIT_SHA: ${{ gitea.sha }}
+          DOCKER_IMAGE: git.anchorhost.eu/anchorhost.eu/anchorhost-frontend
+        run: |
+          docker push "$DOCKER_IMAGE:frontend"
+          docker push "$DOCKER_IMAGE:main-${COMMIT_SHA:0:12}"
 
-      - name: Log out from Docker Hub
+      - name: Log out from Gitea Container Registry
         if: always()
         run: docker logout
 
diff --git a/README.md b/README.md
index af624bd..e0dbd66 100644
--- a/README.md
+++ b/README.md
@@ -17,6 +17,6 @@ Edit the root `branding.json` to set the product name, domain, logo path, public
 
 ## Gitea Actions Docker publishing
 
-`.gitea/workflows/docker.yml` builds the Docker image when `main` is updated and can also be started manually from the Actions page. It publishes `git.anchorhost.eu/anchorhost.eu/anchorhost-frontend:main-latest` and a commit-specific `main-<12 character SHA>` tag to the Gitea Container Registry. The workflow uses Gitea's job token with only `contents: read` and `packages: write`; no registry password secret is needed.
+`.gitea/workflows/docker.yml` builds the Docker image when `main` is updated and can also be started manually from the Actions page. It publishes `git.anchorhost.eu/anchorhost.eu/anchorhost-frontend:frontend` and a commit-specific `main-<12 character SHA>` tag to the Gitea Container Registry. The workflow logs in with Gitea's per-job `GITEA_TOKEN`, granted `contents: read` and `packages: write`; no registry password secret is needed.
 
-Enable Actions and the Container Registry for the repository, and register an `ubuntu-latest` runner that has the Docker CLI and access to a working Docker daemon. The workflow cannot build until that runner is available. `.dockerignore` keeps local dependencies, Git history, build output, and recovered production artifacts out of the build context.
+Enable Actions for the repository and ensure a runner with the Docker CLI and a working Docker daemon is registered. `.dockerignore` keeps local dependencies, Git history, build output, and recovered production artifacts out of the build context.