diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 473e57b..3e7ad52 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -95,39 +95,16 @@ jobs:
           context: .
           file: ./Containerfile
           platforms: linux/amd64
+          push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.metadata.outputs.tags }}
           labels: ${{ steps.metadata.outputs.labels }}
-
-          pull: true
-
           oci-mediatypes: true
           compression: zstd
-
           provenance: false
           sbom: false
-
-          cache-from: ${{ github.event_name != 'pull_request' && format('type=registry,ref={0}/{1}:buildcache-amd64-main', env.IMAGE_REGISTRY, env.IMAGE_NAME) || '' }}
-          cache-to: ${{ github.event_name != 'pull_request' && format('type=registry,ref={0}/{1}:buildcache-amd64-main,mode=max', env.IMAGE_REGISTRY, env.IMAGE_NAME) || '' }}
-
-          build-args: |
-            BUILDKIT_OCI_MEDIATYPE=true
-
-          outputs: ${{ github.event_name != 'pull_request' && format('type=registry,push=true,oci-mediatypes=true,compression=zstd,compression-args=binary-path=/usr/bin/go-zstd-chunked') || '' }}
-      - name: Inspect pushed image
-        if: github.event_name != 'pull_request' && github.ref_name == 'main'
-        run: |
-          set -euo pipefail
-
-          IMAGE="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}"
-          DIGEST="${{ steps.build_image.outputs.digest }}"
-
-          echo "Buildx digest:"
-          echo "${DIGEST}"
-
-          echo
-          echo "Registry digest:"
-          docker buildx imagetools inspect \
-          "${IMAGE}:${DEFAULT_TAG}"
+          cache-from: type=registry,ref=${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache-amd64-main
+          cache-to: type=registry,ref=${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache-amd64-main,mode=max
+          outputs: type=registry,oci-mediatypes=true,compression=zstd,compression-args=binary-path=/usr/bin/go-zstd-chunked
 
       - name: Install gettext dependencies
         if: github.event_name != 'pull_request' && github.ref_name == 'main'
@@ -165,7 +142,7 @@ jobs:
             --registry-referrers-mode=legacy \
             "${IMAGE}@${DIGEST}"
 
-      - name: Debug container signature
+      - name: Verify container image
         if: github.event_name != 'pull_request' && github.ref_name == 'main'
         run: |
           set -euo pipefail
@@ -173,24 +150,11 @@ jobs:
           IMAGE="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}"
           DIGEST="${{ steps.build_image.outputs.digest }}"
 
-          echo "Image: ${IMAGE}"
-          echo "Digest: ${DIGEST}"
+          test -f configs/cosign.pub
 
-          echo
-          echo "=== Cosign version ==="
-          cosign version
-
-          echo
-          echo "=== Cosign tree ==="
-          cosign tree \
-          --registry-referrers-mode=legacy \
-          "${IMAGE}@${DIGEST}"
-
-          echo
-          echo "=== Cosign download signature ==="
-          cosign download signature \
-      -   -registry-referrers-mode=legacy \
-           "${IMAGE}@${DIGEST}"
+          cosign verify \
+            --key configs/cosign.pub \
+            "${IMAGE}@${DIGEST}"
 
       - name: Post-Build Cleanup
         if: always()