diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
new file mode 100644
index 0000000..c8985f2
--- /dev/null
+++ b/.gitea/workflows/build.yaml
@@ -0,0 +1,37 @@
+# Build the site image and push it to this Gitea instance's container
+# registry. Registry host and owner come from the instance itself, so the
+# same file works on the home Gitea and the VPS Gitea without edits.
+#
+# Needs one repo secret: REGISTRY_TOKEN, a personal access token for the
+# repo owner with package read/write scope.
+
+name: Build image
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    env:
+      SERVER_URL: ${{ gitea.server_url }}
+      OWNER: ${{ gitea.repository_owner }}
+      REPO: ${{ gitea.repository }}
+      SHA: ${{ gitea.sha }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Log in to registry
+        run: |
+          REGISTRY="${SERVER_URL#https://}"
+          echo "REGISTRY=$REGISTRY" >> "$GITHUB_ENV"
+          echo "IMAGE=$REGISTRY/${REPO,,}" >> "$GITHUB_ENV"
+          echo "${{ secrets.REGISTRY_TOKEN }}" | docker login "$REGISTRY" -u "$OWNER" --password-stdin
+
+      - name: Build
+        run: docker build -t "$IMAGE:latest" -t "$IMAGE:${SHA::12}" .
+
+      - name: Push
+        run: docker push --all-tags "$IMAGE"