diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index adf6aa2..ca82379 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -107,14 +107,13 @@ jobs:
         if: github.event_name != 'pull_request'
         uses: sigstore/cosign-installer@v4.1.2
 
-      - name: Sign container image (Force Legacy Tag Mode)
+      - name: Sign container image
         if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
         run: |
+          # Cosign löst das Tag automatisch zum Digest auf und signiert DIESEN
           cosign sign -y \
             --key env://COSIGN_PRIVATE_KEY \
-            --registry-referrers-mode legacy \
-            "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build_image.outputs.digest }}"
+            "humocs-man.duckdns.org/humocs-man/fluffy-pancake@$(skopeo inspect docker://humocs-man.duckdns.org/humocs-man/fluffy-pancake:stable | jq -r .Digest)"
         env:
-          COSIGN_EXPERIMENTAL: false
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
           COSIGN_PASSWORD: ""