diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml
index 4d7ede3..92581e4 100644
--- a/.gitea/workflows/cd.yaml
+++ b/.gitea/workflows/cd.yaml
@@ -43,7 +43,7 @@ jobs:
                   img_pre, wl_pre = NAME_OVERRIDE.get(svc, (svc, svc))
                   image    = f"{img_pre}-{sub}"
                   workload = STATEFULSETS.get(image, f"{wl_pre}-{sub}")
-                  targets.append({"image": image, "dir": d, "workload": workload})
+                  targets.append(f"{image}|{d}|{workload}")
           print("targets=" + json.dumps(targets))
           PY
 
@@ -68,11 +68,16 @@ jobs:
           username: ${{ secrets.REGISTRY_USERNAME }}
           password: ${{ secrets.REGISTRY_PASSWORD }}
 
-      - name: Generate Dockerfile
+      - name: Build and push
         shell: bash
+        env:
+          REGISTRY: ${{ env.REGISTRY }}
+          REPO: ${{ env.REPO }}
+          TARGET: ${{ matrix.target }}
+          SHA_TAG: ${{ needs.discover.outputs.short_sha }}
         run: |
           set -euo pipefail
-          dir='${{ matrix.target.dir }}'
+          IFS='|' read -r image dir _workload <<< "$TARGET"
           entry=$(grep -l "package main" "$dir"/*.go | head -n1)
           cfg=$(basename "$(find "$dir/etc" -maxdepth 1 -name '*.yaml' | head -n1)" 2>/dev/null || echo config.yaml)
           cat > Dockerfile.build <<EOF
@@ -94,18 +99,16 @@ jobs:
           COPY $dir/etc /app/etc
           CMD ["./main", "-f", "etc/$cfg"]
           EOF
-
-      - name: Build and push
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: Dockerfile.build
-          push: true
-          tags: |
-            ${{ env.REGISTRY }}/${{ env.REPO }}/${{ matrix.target.image }}:${{ needs.discover.outputs.short_sha }}
-            ${{ env.REGISTRY }}/${{ env.REPO }}/${{ matrix.target.image }}:latest
-          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.REPO }}/buildcache:${{ matrix.target.image }}
-          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.REPO }}/buildcache:${{ matrix.target.image }},mode=max
+          IMAGE="$REGISTRY/$REPO/$image"
+          CACHE="$REGISTRY/$REPO/buildcache:$image"
+          docker buildx build \
+            --file Dockerfile.build \
+            --tag "$IMAGE:$SHA_TAG" \
+            --tag "$IMAGE:latest" \
+            --cache-from "type=registry,ref=$CACHE" \
+            --cache-to "type=registry,ref=$CACHE,mode=max" \
+            --push \
+            .
 
   rollout:
     needs: [discover, build]
@@ -119,6 +122,8 @@ jobs:
 
       - name: Rollout k01
         env:
+          REGISTRY: ${{ env.REGISTRY }}
+          REPO: ${{ env.REPO }}
           KUBECONFIG_B64: ${{ secrets.K01_KUBECONFIG }}
           SHA_TAG: ${{ needs.discover.outputs.short_sha }}
           TARGETS: ${{ needs.discover.outputs.targets }}
@@ -133,11 +138,10 @@ jobs:
           import json, subprocess, os
           reg = os.environ["REGISTRY"] + "/" + os.environ["REPO"]
           for t in json.loads(os.environ["TARGETS"]):
-              img  = t["image"]
-              wl   = t["workload"]
-              kind = "statefulset" if wl == "snowflake" else "deployment"
-              ref  = f"{reg}/{img}:{os.environ['SHA_TAG']}"
-              cmd  = ["kubectl","-n","juwan","set","image",f"{kind}/{wl}",f"{img}={ref}"]
+              image, _, workload = t.split("|")
+              kind = "statefulset" if workload == "snowflake" else "deployment"
+              ref  = f"{reg}/{image}:{os.environ['SHA_TAG']}"
+              cmd  = ["kubectl","-n","juwan","set","image",f"{kind}/{workload}",f"{image}={ref}"]
               print(" ".join(cmd))
               subprocess.run(cmd, check=False)
           PY