diff --git a/.gitignore b/.gitignore
index 5bdcd17..c32e2a2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,4 @@
 # forgejo actions runner registration token
 .runner*
+# podman authentication
+podman-auth.json
diff --git a/build-containers.sh b/build-containers.sh
index 6dfa05c..38d9df0 100755
--- a/build-containers.sh
+++ b/build-containers.sh
@@ -1,9 +1,7 @@
 #!/usr/bin/env bash
 
 BASEDIR=/etc/forgejo-actions
-
-echo "using key file: ${XDG_RUNTIME_DIR}/containers/auth.json"
-podman login --get-login git.ctbk.de
+AUTH_FILE=/etc/forgejo-actions/podman-auth.json
 
 # extra container tags and pushes for things that we don’t build, but need
 podman pull data.forgejo.org/oci/alpine:latest
@@ -12,13 +10,13 @@ podman pull ghcr.io/catthehacker/ubuntu:act-24.04
 podman tag data.forgejo.org/oci/alpine:latest git.ctbk.de/infra/alpine:latest
 podman tag ghcr.io/catthehacker/ubuntu:act-24.04 git.ctbk.de/infra/ubuntu:act-24.04
 
-podman push git.ctbk.de/infra/alpine:latest
-podman push git.ctbk.de/infra/ubuntu:act-24.04
+podman push --authfile /etc/forgejo-actions/podman-auth.json git.ctbk.de/infra/alpine:latest
+podman push --authfile /etc/forgejo-actions/podman-auth.json git.ctbk.de/infra/ubuntu:act-24.04
 
 for container in "$BASEDIR"/Containerfile.*; do
 	base=$(basename "$container")
 	tag=${base#"Containerfile."}
 	podman build -t "git.ctbk.de/infra/$tag" --cpu-quota 50000 -f "$container" $BASEDIR
-	podman push "git.ctbk.de/infra/$tag"
+	podman --authfile /etc/forgejo-actions/podman-auth.json push "git.ctbk.de/infra/$tag"
 done