diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index da6110a..4e9de92 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,10 +1,13 @@
 name: ci
 
+# Runs on Gitea Actions (git.greboh.dev), which reads .github/workflows when .gitea/workflows does not exist.
 # Pull requests: build, test and build the image without pushing.
 # Push to master (direct or merged PR) or a manual run on master: release.
 #   GitVersion picks the next version (patch by default, "+semver: minor|major" in a commit message for more),
 #   the image is pushed as <version> and latest, and the git tag v<version> is pushed so the next release counts from it.
 #   Argo CD Image Updater (infrastructure repo) deploys the newest <version>; nothing is committed back.
+# Releases run one at a time because the runner runs one job at a time (capacity 1), so each one
+# computes its version after the previous one pushed its tag.
 on:
   push:
     branches: [master]
@@ -13,13 +16,8 @@ on:
     branches: [master]
   workflow_dispatch:
 
-# Releases run one at a time, so each one computes its version after the previous one pushed its tag.
-concurrency:
-  group: ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.number) || 'release' }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 env:
-  IMAGE: ghcr.io/greboh/hearth-api
+  IMAGE: git.greboh.dev/greboh/hearth-api
 
 jobs:
   build:
@@ -50,7 +48,6 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
-      packages: write
     env:
       RELEASE: ${{ github.event_name != 'pull_request' && github.ref == 'refs/heads/master' }}
     steps:
@@ -62,13 +59,14 @@ jobs:
           versionSpec: 6.x
       - id: gitversion
         uses: gittools/actions/gitversion/execute@v4
-      - uses: docker/setup-buildx-action@v3
+      # The built-in token cannot push to the package registry; REGISTRY_TOKEN is a personal access token with write:package.
       - uses: docker/login-action@v3
         if: env.RELEASE == 'true'
         with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          registry: git.greboh.dev
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+      # Default docker builder on the runner's Docker-in-Docker daemon: its layer cache carries over between jobs.
       - uses: docker/build-push-action@v6
         with:
           context: .
@@ -76,8 +74,6 @@ jobs:
           tags: |
             ${{ env.IMAGE }}:${{ steps.gitversion.outputs.majorMinorPatch }}
             ${{ env.IMAGE }}:latest
-          cache-from: type=gha,scope=api
-          cache-to: type=gha,mode=max,scope=api
       - name: Push release tag
         if: env.RELEASE == 'true'
         env:
diff --git a/deploy/api/deployment.yaml b/deploy/api/deployment.yaml
index 323e8c4..10ace63 100644
--- a/deploy/api/deployment.yaml
+++ b/deploy/api/deployment.yaml
@@ -20,7 +20,7 @@ spec:
     spec:
       containers:
         - name: api
-          image: ghcr.io/greboh/hearth-api
+          image: git.greboh.dev/greboh/hearth-api
           imagePullPolicy: IfNotPresent
           ports:
             - name: http