diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index aa356e6..bec3fea 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -17,6 +17,7 @@ jobs:
     name: Build and push images
     runs-on: default
     steps:
+      # cheatsheet: https://nexveridian.com/blog/forgejo-pushing-container-images/
       - name: Install dependencies
         run: |
           nix-env -iA nixpkgs.nodejs nixpkgs.podman nixpkgs.kvmtool
@@ -24,12 +25,23 @@ jobs:
           # configure container policy to accept insecure registry
           mkdir -p ~/.config/containers
           echo '{ "default": [ {"type":"insecureAcceptAnything"} ] }' > ~/.config/containers/policy.json
+  
+          # configure authentication
+          cat > ~/.podman/config.json <<EOF
+          {
+            "auths": {
+              "${{ env.registry }}": {
+                "auth": "$(echo -n "${{ forge.actor }}:${{ env.PACKAGE_TOKEN }}" | base64 -w 0)"
+              }
+            }
+          }
+          EOF
 
       - uses: actions/checkout@v4
 
-      - name: Log into registry
-        run: |
-          echo "${{ secrets.PACKAGE_TOKEN }}" | podman login --username "${{ forge.actor }}" --password-stdin ${{ env.registry }}
+      # - name: Log into registry
+      #   run: |
+      #     echo "${{ secrets.PACKAGE_TOKEN }}" | podman login --username "${{ forge.actor }}" --password-stdin ${{ env.registry }}
 
       - name: Create image
         run: |
@@ -38,4 +50,4 @@ jobs:
 
       - name: Push image
         run: |
-          podman push localhost/${{ env.image }}:${{ env.tag }} ${{ env.registry }}/${{ forge.repo }}/${{ env.image }}:${{ env.tag }}
+          podman push --authfile=~/.podman/config.json localhost/${{ env.image }}:${{ env.tag }} ${{ env.registry }}/${{ forge.repo }}/${{ env.image }}:${{ env.tag }}