diff --git a/.gitea/workflows/docker.yml b/.gitea/workflows/docker.yml
new file mode 100644
index 0000000..753b9b0
--- /dev/null
+++ b/.gitea/workflows/docker.yml
@@ -0,0 +1,59 @@
+name: Docker
+# Builds the frontend for the HOMELAB instance and pushes it to this Gitea's
+# registry.
+#
+# Read the build args before changing anything: Vite inlines import.meta.env at
+# BUILD time, so VITE_API_URL is baked into the bundle and an image is tied to
+# one API. The GitHub build bakes https://api.t4t-gateway.com -- running that
+# image here would serve a UI at t4tgw.ffaerber.duckdns.org that talks to the
+# VPS, so a test signup would create a real account on production. This build
+# bakes the homelab API instead, which is the whole reason the two instances can
+# run side by side and mean anything.
+#
+# VITE_GOOGLE_CLIENT_ID comes from a repo secret; unset, Google sign-in is the
+# only thing that breaks, and the rest of the instance still exercises.
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+env:
+  HOMELAB_API_URL: https://t4tgw-api.ffaerber.duckdns.org
+
+jobs:
+  build:
+    runs-on: ci-runner
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build
+        run: |
+          set -eu
+          SHA=$(echo "${{ github.sha }}" | cut -c1-7)
+          echo "IMAGE=git.ffaerber.duckdns.org/token-for-token/hosted-gateway-frontend" >> "$GITHUB_ENV"
+          echo "SHA=$SHA" >> "$GITHUB_ENV"
+          docker build \
+            --build-arg VITE_API_URL="$HOMELAB_API_URL" \
+            --build-arg VITE_GOOGLE_CLIENT_ID="${{ secrets.VITE_GOOGLE_CLIENT_ID }}" \
+            --build-arg VITE_COMMIT_SHA=${{ github.sha }} \
+            -t "git.ffaerber.duckdns.org/token-for-token/hosted-gateway-frontend:$SHA" .
+
+      - name: Push
+        if: github.event_name != 'pull_request'
+        run: |
+          set -eu
+          echo "${{ secrets.GITEA_TOKEN }}" | docker login git.ffaerber.duckdns.org -u "${{ github.actor }}" --password-stdin
+          docker tag "$IMAGE:$SHA" "$IMAGE:latest"
+          docker push "$IMAGE:$SHA"
+          docker push "$IMAGE:latest"
+          docker logout git.ffaerber.duckdns.org
+          {
+            echo "### Pushed"
+            echo
+            echo '```'
+            echo "$IMAGE:$SHA"
+            echo '```'
+            echo
+            echo "API baked in: $HOMELAB_API_URL"
+          } >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
deleted file mode 100644
index 127de4b..0000000
--- a/.github/workflows/docker-image.yml
+++ /dev/null
@@ -1,54 +0,0 @@
-name: Docker Image CI
-
-on:
-  push:
-    branches: ['main', 'develop']
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Build and push
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./Dockerfile
-          push: true
-          tags: |
-            ghcr.io/${{ github.repository_owner }}/hosted-gateway-frontend:${{ github.ref_name }}
-            ghcr.io/${{ github.repository_owner }}/hosted-gateway-frontend:${{ github.sha }}
-          build-args: |
-            VITE_API_URL=https://api.t4t-gateway.com
-            VITE_GOOGLE_CLIENT_ID=${{ secrets.VITE_GOOGLE_CLIENT_ID }}
-            VITE_COMMIT_SHA=${{ github.sha }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
-      - name: docker stack deploy
-        uses: appleboy/ssh-action@v1.0.3
-        with:
-          username: root
-          host: ${{ secrets.SSH_KNOWN_HOSTS }}
-          key: ${{ secrets.SSH_PRIV_KEY }}
-          script: |
-            echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin
-            docker pull ghcr.io/token-for-token/hosted-gateway-frontend:main
-            docker stack deploy -c ~/devops/hostinger/prod-stack.yaml prod --with-registry-auth --resolve-image always
-            docker image prune -f --filter "until=24h"