diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
new file mode 100644
index 0000000..e90d0f3
--- /dev/null
+++ b/.gitea/workflows/ci.yml
@@ -0,0 +1,51 @@
+# Continuous integration on git.menzel.center (Gitea Actions).
+#
+# Builds and pushes the three images to this instance's container registry
+# on every push to main: backend, frontend, and agent (which is built FROM
+# the backend image - see agent/Dockerfile - so it has to come after).
+#
+# Runs on ubuntu-latest, not the docker label: that label's image is a bare
+# docker:24-dind with no Node/bash, which breaks actions/checkout (a JS
+# action). ubuntu-latest has both a shell and the Docker CLI, talking to the
+# host daemon through the socket the runner passes in.
+
+name: CI
+
+on:
+  push:
+    branches: [main]
+
+env:
+  REGISTRY: git.menzel.center/menzeljonas
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.CI_TOKEN }}
+
+      - name: Log in to the registry
+        run: |
+          echo "${{ secrets.CI_TOKEN }}" | docker login git.menzel.center -u menzeljonas --password-stdin
+
+      - name: Build and push backend
+        run: |
+          docker build -t "$REGISTRY/stackpilot-backend:latest" ./backend
+          docker push "$REGISTRY/stackpilot-backend:latest"
+
+      - name: Build and push frontend
+        run: |
+          docker build -t "$REGISTRY/stackpilot-frontend:latest" ./frontend
+          docker push "$REGISTRY/stackpilot-frontend:latest"
+
+      # Uses the backend image just pushed above as its base (already in the
+      # local Docker cache from that step, so this doesn't need to pull it).
+      - name: Build and push agent
+        run: |
+          docker build \
+            --build-arg "BACKEND_IMAGE=$REGISTRY/stackpilot-backend:latest" \
+            -t "$REGISTRY/stackpilot-agent:latest" \
+            ./agent
+          docker push "$REGISTRY/stackpilot-agent:latest"
diff --git a/agent/Dockerfile b/agent/Dockerfile
index 5845ec1..48068da 100644
--- a/agent/Dockerfile
+++ b/agent/Dockerfile
@@ -1,6 +1,6 @@
 # The agent reuses the backend image (same compose/Docker code + deps) and
 # just runs a different ASGI app. Build the backend image first.
-ARG BACKEND_IMAGE=10.10.6.10:3020/menzelj/stackpilot-backend:latest
+ARG BACKEND_IMAGE=git.menzel.center/menzeljonas/stackpilot-backend:latest
 FROM ${BACKEND_IMAGE}
 
 ENV STACKS_DIR=/opt/stacks \
diff --git a/agent/docker-compose.yml b/agent/docker-compose.yml
index 3e67f91..292814e 100644
--- a/agent/docker-compose.yml
+++ b/agent/docker-compose.yml
@@ -3,11 +3,11 @@
 # token you enter when adding this host in the central StackPilot UI).
 services:
   agent:
-    image: 10.10.6.10:3020/menzelj/stackpilot-agent:latest
+    image: git.menzel.center/menzeljonas/stackpilot-agent:latest
     build:
       context: .
       args:
-        BACKEND_IMAGE: 10.10.6.10:3020/menzelj/stackpilot-backend:latest
+        BACKEND_IMAGE: git.menzel.center/menzeljonas/stackpilot-backend:latest
     restart: unless-stopped
     environment:
       - AGENT_TOKEN=${AGENT_TOKEN:?set AGENT_TOKEN in .env}
diff --git a/docker-compose.yml b/docker-compose.yml
index 012fad6..798a8a9 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
   backend:
-    image: 10.10.6.10:3020/menzelj/stackpilot-backend:latest
+    image: git.menzel.center/menzeljonas/stackpilot-backend:latest
     build: ./backend
     restart: unless-stopped
     environment:
@@ -43,7 +43,7 @@ services:
     #   - "5008:5008"
 
   frontend:
-    image: 10.10.6.10:3020/menzelj/stackpilot-frontend:latest
+    image: git.menzel.center/menzeljonas/stackpilot-frontend:latest
     build: ./frontend
     restart: unless-stopped
     depends_on: