diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
new file mode 100644
index 0000000..8c879d5
--- /dev/null
+++ b/.gitea/workflows/build.yml
@@ -0,0 +1,131 @@
+name: Build and Publish dns-sync Image
+
+on:
+  push:
+    branches: [ main ]
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      # -------------------------------------------------
+      # Checkout (manual, no Node, no external actions)
+      # -------------------------------------------------
+      - name: Checkout repository
+        env:
+          GITEA_TOKEN: ${{ secrets.TEA_TOKEN }}
+        run: |
+          set -euo pipefail
+
+          rm -rf ./* ./.git || true
+
+          BASE="${GITHUB_SERVER_URL%/}"
+          REPO="${GITHUB_REPOSITORY}"
+
+          if [ -n "${GITEA_TOKEN:-}" ]; then
+            CLONE_URL="${BASE}/${REPO}.git"
+            CLONE_URL="$(echo "$CLONE_URL" | sed -E 's#^https://#https://oauth2:'"${GITEA_TOKEN}"'@#')"
+            git clone "$CLONE_URL" .
+          else
+            git clone "${BASE}/${REPO}.git" .
+          fi
+
+          git config --global --add safe.directory "$PWD"
+
+      # -------------------------------------------------
+      # Test source before building
+      # -------------------------------------------------
+      - name: Run test suite
+        run: |
+          set -euo pipefail
+
+          python3 -m pip install --user requests PyYAML
+
+          python3 -m unittest discover \
+            -s tests \
+            -v
+
+      # -------------------------------------------------
+      # Build image
+      # -------------------------------------------------
+      - name: Build image
+        env:
+          REGISTRY: ${{ vars.REGISTRY }}
+        run: |
+          set -euo pipefail
+
+          SHORT_SHA="${GITHUB_SHA::7}"
+          FULL_IMAGE="$REGISTRY/david/dns-sync"
+
+          docker build \
+            -f Containerfile \
+            -t "$FULL_IMAGE:latest" \
+            -t "$FULL_IMAGE:sha-$SHORT_SHA" \
+            .
+
+      # -------------------------------------------------
+      # Verify locally before publishing
+      # -------------------------------------------------
+      - name: Verify image
+        env:
+          REGISTRY: ${{ vars.REGISTRY }}
+        run: |
+          set -euo pipefail
+
+          FULL_IMAGE="$REGISTRY/david/dns-sync"
+
+          docker image inspect "$FULL_IMAGE:latest" >/dev/null
+
+          docker run --rm \
+            --entrypoint python \
+            "$FULL_IMAGE:latest" \
+            -m dns_sync reconcile --help
+
+          echo
+          echo "Built image:"
+          docker image ls "$FULL_IMAGE"
+
+      # -------------------------------------------------
+      # Login to container registry
+      # -------------------------------------------------
+      - name: Docker login
+        env:
+          REGISTRY: ${{ vars.REGISTRY }}
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_TOKEN: ${{ secrets.TEA_TOKEN }}
+        run: |
+          set -euo pipefail
+
+          echo "$REGISTRY_TOKEN" | docker login "$REGISTRY" \
+            -u "$REGISTRY_USER" \
+            --password-stdin
+
+      # -------------------------------------------------
+      # Publish
+      # -------------------------------------------------
+      - name: Publish image
+        env:
+          REGISTRY: ${{ vars.REGISTRY }}
+        run: |
+          set -euo pipefail
+
+          SHORT_SHA="${GITHUB_SHA::7}"
+          FULL_IMAGE="$REGISTRY/david/dns-sync"
+
+          docker push "$FULL_IMAGE:latest"
+          docker push "$FULL_IMAGE:sha-$SHORT_SHA"
+
+      - name: Report published image
+        env:
+          REGISTRY: ${{ vars.REGISTRY }}
+        run: |
+          set -euo pipefail
+
+          SHORT_SHA="${GITHUB_SHA::7}"
+          FULL_IMAGE="$REGISTRY/david/dns-sync"
+
+          echo "Published:"
+          echo "  $FULL_IMAGE:latest"
+          echo "  $FULL_IMAGE:sha-$SHORT_SHA"