diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index fca7157..098576a 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -1,3 +1,10 @@
+# =============================================================================
+# Forgejo Actions workflow to build and push Docker image
+# =============================================================================
+# Triggered on push to main. Pushes :latest plus :$SHA tags; the SHA matches
+# what the service reports at GET /version.
+# -----------------------------------------------------------------------------
+
 name: Build and push container image
 
 on:
@@ -10,21 +17,30 @@ env:
 jobs:
   build-and-push:
     runs-on: docker
+    permissions:
+      contents: read
+      packages: write
+
     steps:
-      - name: Checkout
+      - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Set up Buildx
+      - name: Install Docker CLI
+        run: |
+          apt-get update -qq
+          apt-get install -y --no-install-recommends docker.io
+
+      - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Login to Forgejo registry
+      - name: Login to Registry
         uses: docker/login-action@v3
         with:
           registry: git.workaround.org
-          username: chaas
+          username: ${{ github.actor }}
           password: ${{ secrets.FORGEJO_TOKEN }}
 
-      - name: Build and push
+      - name: Build and Push
         uses: docker/build-push-action@v6
         with:
           context: .
@@ -34,3 +50,5 @@ jobs:
           tags: |
             ${{ env.IMAGE }}:latest
             ${{ env.IMAGE }}:${{ github.sha }}
+          cache-from: type=registry,ref=${{ env.IMAGE }}:buildcache
+          cache-to: type=registry,ref=${{ env.IMAGE }}:buildcache,mode=max