diff --git a/.gitea/workflows/container.yml b/.gitea/workflows/container.yml
index 4ba7f47..06bef6b 100644
--- a/.gitea/workflows/container.yml
+++ b/.gitea/workflows/container.yml
@@ -11,38 +11,48 @@ env:
 jobs:
   test:
     name: Check JavaScript
-    runs-on: ubuntu-latest
+    runs-on: linux_amd64
     steps:
       - name: Check out source
         uses: actions/checkout@v4
       - name: Check server and browser scripts
         run: |
-          docker run --rm --interactive node:24-alpine node --check - < server.js
-          docker run --rm --interactive node:24-alpine node --check - < database.js
-          docker run --rm --interactive node:24-alpine node --check - < public/app.js
-          docker run --rm --interactive node:24-alpine node --check - < public/admin.js
+          authfile=$(mktemp)
+          trap 'rm -f "$authfile"' EXIT
+          printf '{"auths":{}}' > "$authfile"
+          export REGISTRY_AUTH_FILE="$authfile"
+          podman run --rm --interactive docker.io/library/node:24-alpine node --check - < server.js
+          podman run --rm --interactive docker.io/library/node:24-alpine node --check - < database.js
+          podman run --rm --interactive docker.io/library/node:24-alpine node --check - < public/app.js
+          podman run --rm --interactive docker.io/library/node:24-alpine node --check - < public/admin.js
 
   publish:
     name: Build and push
+    if: gitea.ref == 'refs/heads/main'
     needs: test
-    runs-on: ubuntu-latest
+    runs-on: linux_amd64
     steps:
       - name: Check out source
         uses: actions/checkout@v4
 
-      - name: Log in to Quay
-        uses: docker/login-action@v3
-        with:
-          registry: registry.brunner.ninja
-          username: ${{ secrets.QUAY_USERNAME }}
-          password: ${{ secrets.QUAY_TOKEN }}
+      - name: Configure isolated registry access
+        env:
+          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
+          QUAY_TOKEN: ${{ secrets.QUAY_TOKEN }}
+        run: |
+          set -euo pipefail
+          authfile="${RUNNER_TEMP}/quay-auth.json"
+          printf '{"auths":{}}' > "$authfile"
+          chmod 0600 "$authfile"
+          printf '%s' "$QUAY_TOKEN" | podman login registry.brunner.ninja \
+            --authfile "$authfile" --username "$QUAY_USERNAME" --password-stdin
+          echo "REGISTRY_AUTH_FILE=$authfile" >> "$GITHUB_ENV"
 
       - name: Build image
         env:
           COMMIT_SHA: ${{ gitea.sha }}
         run: |
-          docker build \
-            --load \
+          podman build \
             --label "org.opencontainers.image.revision=${COMMIT_SHA}" \
             --label "org.opencontainers.image.source=https://code.brunner.ninja/feedc0de/30-birthday" \
             --tag "${IMAGE}:${COMMIT_SHA}" \
@@ -51,15 +61,19 @@ jobs:
       - name: Push commit tag
         env:
           COMMIT_SHA: ${{ gitea.sha }}
-        run: docker push "${IMAGE}:${COMMIT_SHA}"
+        run: podman push "${IMAGE}:${COMMIT_SHA}"
 
       - name: Push latest tag
         if: gitea.ref == 'refs/heads/main'
         env:
           COMMIT_SHA: ${{ gitea.sha }}
         run: |
-          docker tag "${IMAGE}:${COMMIT_SHA}" "${IMAGE}:latest"
-          docker push "${IMAGE}:latest"
+          podman tag "${IMAGE}:${COMMIT_SHA}" "${IMAGE}:latest"
+          podman push "${IMAGE}:latest"
+
+      - name: Remove registry credentials
+        if: always()
+        run: rm -f "${RUNNER_TEMP}/quay-auth.json"
 
   deploy:
     name: Deploy to Kubernetes
diff --git a/Dockerfile b/Dockerfile
index a4cb533..d92ba95 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM node:24-alpine
+FROM docker.io/library/node:24-alpine
 
 ENV NODE_ENV=production \
     PORT=3000 \