diff --git a/.gitea/workflows/publish.yml b/.gitea/workflows/publish.yml
new file mode 100644
index 0000000..d82b0f0
--- /dev/null
+++ b/.gitea/workflows/publish.yml
@@ -0,0 +1,38 @@
+# Builds and pushes the kforge Docker action image on every push to main.
+# Other repos reference this image via:
+#   action_ref: registry.natelubitz.com/infra/kforge:latest
+# in their kforge.yml, which generates:
+#   uses: docker://registry.natelubitz.com/infra/kforge:latest
+
+name: Publish Action Image
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Login to registry
+        uses: docker/login-action@v2
+        with:
+          registry: registry.natelubitz.com
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Build and push kforge action image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          platforms: linux/amd64
+          push: true
+          tags: |
+            registry.natelubitz.com/infra/kforge:latest
+            registry.natelubitz.com/infra/kforge:${{ gitea.sha }}
+          provenance: false
+          sbom: false
diff --git a/internal/config/types.go b/internal/config/types.go
index 96cb70a..b47c0b4 100644
--- a/internal/config/types.go
+++ b/internal/config/types.go
@@ -15,10 +15,11 @@ type KforgeConfig struct {
 	Preview        PreviewConfig                `yaml:"preview,omitempty"`
 	Environments   map[string]EnvironmentConfig `yaml:"environments"`
 
-	// ActionRef is the Gitea Actions reference to this kforge installation
-	// (e.g. "gitea.example.com/infra/kforge@main"). When set, kforge gitea-actions
-	// and kforge gitea-preview generate workflows that call kforge as a reusable
-	// action step instead of installing and running kforge inline.
+	// ActionRef is the Docker image reference for the pre-built kforge action
+	// (e.g. "registry.example.com/infra/kforge:latest"). When set, kforge
+	// gitea-actions and kforge gitea-preview generate `uses: docker://<ref>`
+	// steps instead of installing and running kforge inline. The kforge repo
+	// must publish this image on each release.
 	ActionRef string `yaml:"action_ref,omitempty"`
 }
 
diff --git a/internal/generator/gitea_actions.go b/internal/generator/gitea_actions.go
index 960fc4e..5876620 100644
--- a/internal/generator/gitea_actions.go
+++ b/internal/generator/gitea_actions.go
@@ -104,8 +104,11 @@ func writeDeployJobs(b *strings.Builder, cfg *config.KforgeConfig, opts GiteaAct
 	}
 }
 
-// writeActionDeploySteps emits one `uses: action_ref` step per environment.
+// writeActionDeploySteps emits one `uses: docker://image` step per environment.
+// The docker:// prefix tells act/Gitea Actions to pull the image from the OCI
+// registry directly, bypassing GitHub/Gitea source resolution.
 func writeActionDeploySteps(b *strings.Builder, cfg *config.KforgeConfig, opts GiteaActionsOptions) {
+	image := "docker://" + cfg.ActionRef
 	for _, envKey := range opts.Environments {
 		env, err := config.ResolveEnvironment(cfg, envKey)
 		if err != nil {
@@ -113,7 +116,7 @@ func writeActionDeploySteps(b *strings.Builder, cfg *config.KforgeConfig, opts G
 		}
 		label := strings.Title(envKey) //nolint:staticcheck
 		writeStep(b, fmt.Sprintf("Deploy (%s)", label), map[string]any{
-			"uses": cfg.ActionRef,
+			"uses": image,
 			"with": map[string]any{
 				"command":   "deploy",
 				"env":       envKey,
@@ -274,12 +277,13 @@ func GeneratePreviewActions(cfg *config.KforgeConfig) (string, error) {
 	})
 
 	if cfg.ActionRef != "" {
+		image := "docker://" + cfg.ActionRef
 		writeStep(&b, "Deploy preview", map[string]any{
 			"if":   "${{ github.event.action != 'closed' }}",
-			"uses": cfg.ActionRef,
+			"uses": image,
 			"with": map[string]any{
-				"command":   "preview-up",
-				"pr_number": "${{ github.event.number }}",
+				"command":          "preview-up",
+				"pr_number":        "${{ github.event.number }}",
 				"namespace_prefix": nsPrefix,
 			},
 			"env": actionEnv(),
@@ -287,7 +291,7 @@ func GeneratePreviewActions(cfg *config.KforgeConfig) (string, error) {
 
 		writeStep(&b, "Destroy preview", map[string]any{
 			"if":   "${{ github.event.action == 'closed' }}",
-			"uses": cfg.ActionRef,
+			"uses": image,
 			"with": map[string]any{
 				"command":          "preview-down",
 				"pr_number":        "${{ github.event.number }}",