diff --git a/.gitea/workflows/build_push.yml b/.gitea/workflows/build_push.yml
index 159937d..deaec02 100644
--- a/.gitea/workflows/build_push.yml
+++ b/.gitea/workflows/build_push.yml
@@ -41,16 +41,28 @@ jobs:
 
       - name: Create Kubeconfig
         run: |
-          mkdir $HOME/.kube
+          mkdir -p $HOME/.kube
           echo "${{ secrets.KUBEC_CONFIG_BUILDX }}" > $HOME/.kube/config
 
-      - name: Set up Docker Buildx
+      - name: Set up Docker Buildx (remote -> persistent buildkit daemon)
         uses: docker/setup-buildx-action@v3
         with:
-          driver: kubernetes
-          driver-opts: |
-            namespace=gitea-runner
-            qemu.install=true
+          # The `kubernetes` driver talks to the cluster API, which needs the
+          # k3s CA certificate.  The job container does not have it, so the
+          # bootstrap failed with "x509: certificate signed by unknown
+          # authority".
+          #
+          # The `remote` driver talks straight to the buildkit daemon that is
+          # already running in the cluster, so no cluster API access (and no
+          # kubeconfig) is needed at all.  This is the same pattern the
+          # wedding-photos workflow uses successfully.
+          #
+          # NOTE: `endpoint` must be passed as a top-level key.  The action
+          # appends it as the POSITIONAL argument to
+          # `buildx create --driver remote <endpoint>`; putting it in
+          # driver-opts instead yields "ERROR: no remote endpoint provided".
+          driver: remote
+          endpoint: tcp://buildkit.gitea-runner.svc:1234
 
       - name: Login to Docker Registry
         uses: docker/login-action@v3
@@ -65,7 +77,10 @@ jobs:
           context: .
           push: true
           file: base.Dockerfile
-          platforms: linux/amd64,linux/arm64
+          # amd64 only.  A multi-arch build runs qemu emulation, which crashes
+          # the buildkit pod on this NUC (exit 255, SandboxChanged) and the
+          # build then hangs for many minutes.  The cluster is amd64.
+          platforms: linux/amd64
           tags: |
             git.aridgwayweb.com/armistace/beer_base_image:latest
 
@@ -75,6 +90,6 @@ jobs:
           context: .
           push: true
           file: flask.Dockerfile
-          platforms: linux/amd64,linux/arm64
+          platforms: linux/amd64
           tags: |
             git.aridgwayweb.com/armistace/beer-data:latest