diff --git a/.gitea/workflows/docker.yaml b/.gitea/workflows/docker.yaml
index ea293f3..3f1b3cb 100644
--- a/.gitea/workflows/docker.yaml
+++ b/.gitea/workflows/docker.yaml
@@ -1,3 +1,6 @@
+# Push Docker — thin caller for the shared reusable workflow.
+#
+# INLINED until 2026-09. The build/push steps live in private/ci now.
 name: Push Docker
 
 on:
@@ -7,31 +10,14 @@ on:
 
 jobs:
   docker:
-    runs-on: ubuntu-latest
+    uses: private/ci/.gitea/workflows/docker-publish.yaml@v1
+    with:
+      mode: release
+      image-target: ${{ vars.DOCKERHUB_TARGET }}
 
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      # See develop.yaml — the build is defined in docker-bake.hcl.
+      build-backend: 'bake'
 
-      - name: Setup Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Extract version
-        id: version
-        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
-
-      - name: Build image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          push: true
-          platforms: linux/amd64,linux/arm64
-          tags: |
-            ${{ vars.DOCKERHUB_TARGET }}:latest
-            ${{ vars.DOCKERHUB_TARGET }}:${{ steps.version.outputs.VERSION }}
+    secrets:
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}