diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index b28afa917..fb09b5647 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -220,28 +220,33 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: bash scripts/registry-auth.sh
 
-      - name: 🐳 Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
       - name: 🔐 Registry Login
         run: echo "${{ secrets.REGISTRY_PASS }}" | docker login registry.infra.mintel.me -u "${{ secrets.REGISTRY_USER }}" --password-stdin
-      - name: 🏗️ Build and Push
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          push: true
-          provenance: false
-          platforms: linux/amd64
-          build-args: |
-            NEXT_PUBLIC_BASE_URL=${{ needs.prepare.outputs.next_public_url }}
-            NEXT_PUBLIC_TARGET=${{ needs.prepare.outputs.target }}
-            NEXT_PUBLIC_APP_VERSION=${{ needs.prepare.outputs.image_tag }}
-            UMAMI_WEBSITE_ID=${{ secrets.UMAMI_WEBSITE_ID || vars.UMAMI_WEBSITE_ID }}
-            UMAMI_API_ENDPOINT=${{ secrets.UMAMI_API_ENDPOINT || vars.UMAMI_API_ENDPOINT || 'https://analytics.infra.mintel.me' }}
-            NPM_TOKEN=${{ steps.auth.outputs.working_token }}
-            NPM_DOMAIN=${{ steps.auth.outputs.working_domain }}
-          tags: registry.infra.mintel.me/mintel/e-tib.com:${{ needs.prepare.outputs.image_tag }}
-          secrets: |
-            "NPM_TOKEN=${{ steps.auth.outputs.working_token }}"
+      - name: 🏗️ Build and Push (Native Docker Buildkit)
+        env:
+          NEXT_PUBLIC_BASE_URL: ${{ needs.prepare.outputs.next_public_url }}
+          NEXT_PUBLIC_TARGET: ${{ needs.prepare.outputs.target }}
+          NEXT_PUBLIC_APP_VERSION: ${{ needs.prepare.outputs.image_tag }}
+          UMAMI_WEBSITE_ID: ${{ secrets.UMAMI_WEBSITE_ID || vars.UMAMI_WEBSITE_ID }}
+          UMAMI_API_ENDPOINT: ${{ secrets.UMAMI_API_ENDPOINT || vars.UMAMI_API_ENDPOINT || 'https://analytics.infra.mintel.me' }}
+          NPM_TOKEN: ${{ steps.auth.outputs.working_token }}
+          NPM_DOMAIN: ${{ steps.auth.outputs.working_domain }}
+          IMAGE_TAG: ${{ needs.prepare.outputs.image_tag }}
+        run: |
+          echo "$NPM_TOKEN" > npm_token.txt
+          DOCKER_BUILDKIT=1 docker build \
+            --secret id=NPM_TOKEN,src=npm_token.txt \
+            --build-arg NEXT_PUBLIC_BASE_URL="$NEXT_PUBLIC_BASE_URL" \
+            --build-arg NEXT_PUBLIC_TARGET="$NEXT_PUBLIC_TARGET" \
+            --build-arg NEXT_PUBLIC_APP_VERSION="$IMAGE_TAG" \
+            --build-arg UMAMI_WEBSITE_ID="$UMAMI_WEBSITE_ID" \
+            --build-arg UMAMI_API_ENDPOINT="$UMAMI_API_ENDPOINT" \
+            --build-arg NPM_TOKEN="$NPM_TOKEN" \
+            --build-arg NPM_DOMAIN="$NPM_DOMAIN" \
+            -t registry.infra.mintel.me/mintel/e-tib.com:"$IMAGE_TAG" \
+            .
+          docker push registry.infra.mintel.me/mintel/e-tib.com:"$IMAGE_TAG"
+          rm -f npm_token.txt
 
   # ──────────────────────────────────────────────────────────────────────────────
   # JOB 4: Deploy