diff --git a/.dockerignore b/.dockerignore
index 63d15e6..63d25b4 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,8 +1,8 @@
 build
 .git
+.gitea
 .gitignore
 Dockerfile*
 README.md
 *.yaml
 install.sh
-
diff --git a/.gitea/workflows/container.yml b/.gitea/workflows/container.yml
new file mode 100644
index 0000000..72ef736
--- /dev/null
+++ b/.gitea/workflows/container.yml
@@ -0,0 +1,46 @@
+name: Publish container image
+
+on:
+  push:
+
+env:
+  IMAGE: registry.brunner.ninja/feedc0de/immich-sync
+
+jobs:
+  publish:
+    name: Build and push
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v4
+
+      - name: Log in to Quay
+        uses: docker/login-action@v3
+        with:
+          registry: registry.brunner.ninja
+          username: ${{ secrets.QUAY_USERNAME }}
+          password: ${{ secrets.QUAY_TOKEN }}
+
+      - name: Build image
+        env:
+          COMMIT_SHA: ${{ gitea.sha }}
+        run: |
+          docker build \
+            --label "org.opencontainers.image.revision=${COMMIT_SHA}" \
+            --label "org.opencontainers.image.source=https://code.brunner.ninja/feedc0de/immich-sync" \
+            --tag "${IMAGE}:${COMMIT_SHA}" \
+            .
+
+      - name: Push commit tag
+        env:
+          COMMIT_SHA: ${{ gitea.sha }}
+        run: docker push "${IMAGE}:${COMMIT_SHA}"
+
+      - name: Push latest tag
+        if: gitea.ref == 'refs/heads/main'
+        env:
+          COMMIT_SHA: ${{ gitea.sha }}
+        run: |
+          docker tag "${IMAGE}:${COMMIT_SHA}" "${IMAGE}:latest"
+          docker push "${IMAGE}:latest"
diff --git a/README.md b/README.md
index b3234e0..c6b9d45 100644
--- a/README.md
+++ b/README.md
@@ -72,6 +72,24 @@ docker run --rm -p 8090:8090 registry.brunner.ninja/feedc0de/immich-sync:latest
 
 The Kubernetes manifest follows the neighboring `brunner-ninja` and `visual-studio-code` layout. It assumes the image name and `immich-sync.brunner.ninja` hostname shown in the manifest. It enables the existing Authentik Traefik middleware because accepting arbitrary server URLs creates an SSRF/bandwidth-abuse surface; remove that annotation only if intentionally exposing the service publicly.
 
+## Continuous delivery
+
+The Gitea Actions workflow in `.gitea/workflows/container.yml` builds and pushes
+`registry.brunner.ninja/feedc0de/immich-sync`. Every pushed commit receives an immutable tag containing its full Git
+SHA. A commit pushed to `main` receives both its SHA tag and `latest` from the same image build.
+
+The workflow deliberately uses the Docker engine's plain `docker build` and `docker push` commands. It does not use
+Buildx and does not publish provenance attestations, SBOM manifests, or OCI referrers, retaining compatibility with
+the self-hosted Quay registry.
+
+The workflow expects these Gitea Actions repository secrets:
+
+- `QUAY_USERNAME`: the complete Quay robot account name, including the `feedc0de+` prefix.
+- `QUAY_TOKEN`: the robot account token.
+
+Give the robot account `Write` permission only on the `feedc0de/immich-sync` repository. Public image pulls do not use
+these credentials and do not require a Gitea secret.
+
 ## Current scope
 
 - Assets without a checksum are ignored by planning.