diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 19bfc2d..c14f1dd 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -125,23 +125,33 @@ jobs:
           LC_ALL: en_US.UTF-8
         run: ./scripts/build-release.ps1 -Targets win,linux-appimage -Tag $env:TAG
 
-      - name: Log in to git.azuze.fr
-        uses: docker/login-action@v3
-        with:
-          registry: git.azuze.fr
-          username: ${{ secrets.BUILD_USER }}
-          password: ${{ secrets.BUILD_TOKEN }}
-
-      - uses: docker/setup-buildx-action@v3
-
+      # Plain docker rather than docker/login-action + setup-buildx-action +
+      # build-push-action. This is a single-platform build of one Dockerfile, which
+      # dockerd's own integrated BuildKit does; the actions' only added value here
+      # would be the docker-container driver, and standing that up means pulling
+      # moby/buildkit and mounting the socket into it for no gain.
+      #
+      # --password-stdin, never -p: an argument is visible in ps and in the daemon's
+      # process list for as long as the login runs.
       - name: Build and push image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          push: true
-          tags: |
-            ${{ env.IMAGE }}:latest
-            ${{ env.IMAGE }}:${{ steps.vars.outputs.tag }}
+        env:
+          TAG: ${{ steps.vars.outputs.tag }}
+          REGISTRY_USER: ${{ secrets.BUILD_USER }}
+          REGISTRY_TOKEN: ${{ secrets.BUILD_TOKEN }}
+        run: |
+          set -euo pipefail
+          printf '%s' "$REGISTRY_TOKEN" \
+            | docker login git.azuze.fr -u "$REGISTRY_USER" --password-stdin
+          docker build -t "$IMAGE:latest" -t "$IMAGE:$TAG" .
+          docker push "$IMAGE:latest"
+          docker push "$IMAGE:$TAG"
+
+      # This runner is a persistent host, so the credentials written by docker login
+      # would otherwise sit in ~/.docker/config.json between jobs. always(): a failed
+      # build is exactly when they must not be left behind.
+      - name: Log out of git.azuze.fr
+        if: always()
+        run: docker logout git.azuze.fr || true
 
       - name: Publish Gitea release
         env: