diff --git a/.gitea/workflows/build-and-push.yml b/.gitea/workflows/build-and-push.yml
index c6f998b..4e72bb1 100644
--- a/.gitea/workflows/build-and-push.yml
+++ b/.gitea/workflows/build-and-push.yml
@@ -68,7 +68,11 @@ jobs:
         # install step) here rather than in the publish job below.
         run: |
           set -euo pipefail
-          "${{ steps.runtime.outputs.path }}" build -t mirror:ci .
+          # -f is not optional: without it docker looks for "Dockerfile", finds
+          # none, and reports "failed to read dockerfile" with an empty context —
+          # which is exactly how run #2 failed. The publish job gets away without
+          # naming it because docker/build-push-action passes `file:` for us.
+          "${{ steps.runtime.outputs.path }}" build -f Containerfile -t mirror:ci .
           "${{ steps.runtime.outputs.path }}" run --rm mirror:ci --help >/dev/null
 
   build-and-push-app: