diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 4e7e01e..8d5d62a 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -25,12 +25,13 @@ jobs:
       - uses: actions/checkout@v4
       - name: Log in to container registry
         run: echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.gbrown.org -u "${{ secrets.REGISTRY_USER }}" --password-stdin
+      # Fully-qualified tags from the start: unqualified names like
+      # `agentchat:latest` break on podman-backed runners, which resolve them
+      # to docker.io/library/* instead of the local build.
       - name: Build image
-        run: docker build -f docker/Dockerfile -t agentchat:latest .
-      - name: Tag and push
+        run: docker build -f docker/Dockerfile -t git.gbrown.org/gib/agentchat:${{ gitea.sha }} -t git.gbrown.org/gib/agentchat:latest .
+      - name: Push image
         run: |
-          docker tag agentchat:latest git.gbrown.org/gib/agentchat:${{ gitea.sha }}
-          docker tag agentchat:latest git.gbrown.org/gib/agentchat:latest
           docker push git.gbrown.org/gib/agentchat:${{ gitea.sha }}
           docker push git.gbrown.org/gib/agentchat:latest