diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
new file mode 100644
index 0000000..1822bd4
--- /dev/null
+++ b/.gitea/workflows/build.yaml
@@ -0,0 +1,48 @@
+name: Build docker image and push to registry.bitdeals.org
+run-name: docker build and docker push
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    env:
+      COMMIT: ${{ gitea.sha }}
+      REGISTRY: 10.0.3.111:5000
+      IMAGE: bitcoind
+      USER: ${{ secrets.DOCKER_USERNAME }}
+      PASS: ${{ secrets.DOCKER_PASSWORD }}
+    steps:
+      - name: Checkout repository code
+        uses: actions/checkout@v6
+
+      # The version tag comes from the Dockerfile rather than from a second
+      # copy here: the ARG is what the build actually downloads, and a tag that
+      # can disagree with the binary inside is worse than no tag.
+      - name: Resolve the Core version from the Dockerfile
+        run: |
+          v=$(sed -n 's/^ARG BITCOIN_VERSION=//p' docker/Dockerfile)
+          test -n "$v" || { echo "BITCOIN_VERSION not found in docker/Dockerfile" >&2; exit 1; }
+          echo "VERSION=$v" >> "$GITHUB_ENV"
+
+      # Three tags: the immutable one to deploy by, the moving version tag for
+      # people reading `docker images`, and :latest for Watchtower and compose.
+      - name: Build image
+        run: |
+          docker build . \
+            --file docker/Dockerfile \
+            --label "git-commit=$COMMIT" \
+            --tag "${REGISTRY}/${IMAGE}:${VERSION}.${COMMIT::7}" \
+            --tag "${REGISTRY}/${IMAGE}:${VERSION}" \
+            --tag "${REGISTRY}/${IMAGE}:latest"
+
+      - name: Docker login
+        run: docker login --username "$USER" --password "$PASS" "$REGISTRY"
+
+      - name: Push images
+        run: |
+          docker push "${REGISTRY}/${IMAGE}:${VERSION}.${COMMIT::7}"
+          docker push "${REGISTRY}/${IMAGE}:${VERSION}"
+          docker push "${REGISTRY}/${IMAGE}:latest"
diff --git a/README.md b/README.md
index 3d7fc2d..beac197 100644
--- a/README.md
+++ b/README.md
@@ -66,6 +66,11 @@ docker run --rm -v btcdata:/data/.bitcoin registry.bitdeals.org/bitcoind -reinde
 
 ## build and publish
 
+A push to `main` builds and publishes the image (`.gitea/workflows/build.yaml`),
+tagging it three ways: `<version>.<sha7>` to deploy by, `<version>` to read, and
+`latest` for compose and Watchtower. By hand, when the registry credentials are
+at hand:
+
 ```sh
 docker build . --file docker/Dockerfile --tag registry.bitdeals.org/bitcoind
 docker push registry.bitdeals.org/bitcoind
diff --git a/README.ru-RU.md b/README.ru-RU.md
index 23aff0e..b862d8a 100644
--- a/README.ru-RU.md
+++ b/README.ru-RU.md
@@ -67,6 +67,11 @@ docker run --rm -v btcdata:/data/.bitcoin registry.bitdeals.org/bitcoind -reinde
 
 ## сборка и публикация
 
+Пуш в `main` собирает и публикует образ (`.gitea/workflows/build.yaml`) с тремя
+тегами: `<версия>.<sha7>` — для развёртывания, `<версия>` — для чтения глазами,
+`latest` — для compose и Watchtower. Вручную, если под рукой есть учётные данные
+registry:
+
 ```sh
 docker build . --file docker/Dockerfile --tag registry.bitdeals.org/bitcoind
 docker push registry.bitdeals.org/bitcoind