diff --git a/.gitea/workflows/container.yml b/.gitea/workflows/container.yml
index 72ef736..f4b2e36 100644
--- a/.gitea/workflows/container.yml
+++ b/.gitea/workflows/container.yml
@@ -27,6 +27,7 @@ jobs:
           COMMIT_SHA: ${{ gitea.sha }}
         run: |
           docker build \
+            --load \
             --label "org.opencontainers.image.revision=${COMMIT_SHA}" \
             --label "org.opencontainers.image.source=https://code.brunner.ninja/feedc0de/immich-sync" \
             --tag "${IMAGE}:${COMMIT_SHA}" \
diff --git a/README.md b/README.md
index c6b9d45..88fbdb8 100644
--- a/README.md
+++ b/README.md
@@ -78,9 +78,9 @@ The Gitea Actions workflow in `.gitea/workflows/container.yml` builds and pushes
 `registry.brunner.ninja/feedc0de/immich-sync`. Every pushed commit receives an immutable tag containing its full Git
 SHA. A commit pushed to `main` receives both its SHA tag and `latest` from the same image build.
 
-The workflow deliberately uses the Docker engine's plain `docker build` and `docker push` commands. It does not use
-Buildx and does not publish provenance attestations, SBOM manifests, or OCI referrers, retaining compatibility with
-the self-hosted Quay registry.
+The workflow deliberately loads the completed image into the Docker engine and pushes it with a separate plain
+`docker push`. It does not request provenance attestations, SBOM manifests, or OCI referrers, retaining compatibility
+with the self-hosted Quay registry and with Gitea runners whose default builder uses BuildKit's container driver.
 
 The workflow expects these Gitea Actions repository secrets: