diff --git a/.gitea/workflows/build_push.yml b/.gitea/workflows/build_push.yml
index deaec02..d7f41b6 100644
--- a/.gitea/workflows/build_push.yml
+++ b/.gitea/workflows/build_push.yml
@@ -28,6 +28,11 @@ jobs:
           . .venv/bin/activate
           python -m pytest tests/ -q
 
+  # NOTE: the build job deliberately does NOT have a kubeconfig.  The
+  # `KUBEC_CONFIG_BUILDX` secret is cluster-admin-equivalent, and a build step
+  # that has no need of the cluster should not be able to read it.  The deploy
+  # step, added in a later PR, gets its own job with the kubeconfig - that way
+  # a compromised dependency in the build cannot reach the cluster.
   build:
     name: Build and push image
     runs-on: ubuntu-latest
@@ -39,11 +44,6 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Create Kubeconfig
-        run: |
-          mkdir -p $HOME/.kube
-          echo "${{ secrets.KUBEC_CONFIG_BUILDX }}" > $HOME/.kube/config
-
       - name: Set up Docker Buildx (remote -> persistent buildkit daemon)
         uses: docker/setup-buildx-action@v3
         with: