diff --git a/.github/workflows/deployment.yaml b/.github/workflows/deployment.yaml
index 12c5bbc..27f3fd7 100644
--- a/.github/workflows/deployment.yaml
+++ b/.github/workflows/deployment.yaml
@@ -131,6 +131,29 @@ jobs:
       # Both legs live in wanaware-infrastructure. CI plumbing (WIF identifiers,
       # registry host, GH_ACCESS_TOKEN) comes from the runner's Keeper-backed
       # ci-workload env; nothing is a GitHub secret.
+      # ARC runners build through the pod's rootless BuildKit sidecar ($BUILDKIT_HOST):
+      # no Docker daemon and nothing privileged. A non-ARC runner (the runner_label
+      # escape hatch) has no sidecar and gets buildx's default driver instead.
+      - name: Select the image builder
+        if: ${{ inputs.deploy_type != 'release-only' }}
+        id: builder
+        run: |
+          if [ -n "${BUILDKIT_HOST:-}" ]; then
+            echo "driver=remote" >> "$GITHUB_OUTPUT"
+            echo "endpoint=$BUILDKIT_HOST" >> "$GITHUB_OUTPUT"
+          else
+            echo "driver=docker-container" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Set up the image builder
+        if: ${{ inputs.deploy_type != 'release-only' }}
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver: ${{ steps.builder.outputs.driver }}
+          endpoint: ${{ steps.builder.outputs.endpoint }}
+
+      # Built to a tarball rather than loaded into a daemon: Trivy scans the file, and
+      # only a clean image is pushed (the push step rebuilds from the warm cache).
       - name: Build Docker image
         if: ${{ inputs.deploy_type != 'release-only' }}
         id: build
@@ -138,8 +161,7 @@ jobs:
         with:
           context: ${{ inputs.docker_context }}
           file: ${{ inputs.docker_context }}/${{ inputs.dockerfile_path }}
-          push: false
-          load: true
+          outputs: type=docker,dest=${{ runner.temp }}/image.tar
           tags: ${{ env.GCP_REGISTRY }}/${{ env.GCP_PROJECT }}/${{ inputs.image_path }}:latest
           build-args: |
             GH_ACCESS_TOKEN=${{ env.GH_ACCESS_TOKEN }}
@@ -149,7 +171,7 @@ jobs:
         uses: aquasecurity/trivy-action@v0.36.0
         with:
           scan-type: "image"
-          image-ref: ${{ env.GCP_REGISTRY }}/${{ env.GCP_PROJECT }}/${{ inputs.image_path }}:latest
+          input: ${{ runner.temp }}/image.tar
           ignore-unfixed: true
           format: "table"
           severity: "CRITICAL,HIGH"
@@ -157,7 +179,14 @@ jobs:
 
       - name: Push Docker image
         if: ${{ inputs.deploy_type != 'release-only' }}
-        run: docker push ${{ env.GCP_REGISTRY }}/${{ env.GCP_PROJECT }}/${{ inputs.image_path }}:latest
+        uses: docker/build-push-action@v4
+        with:
+          context: ${{ inputs.docker_context }}
+          file: ${{ inputs.docker_context }}/${{ inputs.dockerfile_path }}
+          push: true
+          tags: ${{ env.GCP_REGISTRY }}/${{ env.GCP_PROJECT }}/${{ inputs.image_path }}:latest
+          build-args: |
+            GH_ACCESS_TOKEN=${{ env.GH_ACCESS_TOKEN }}
 
       # --- GKE deploy ---
       - name: Get GKE Credentials
diff --git a/.github/workflows/shared-registry-push.yaml b/.github/workflows/shared-registry-push.yaml
index 00c1944..f29c5dc 100644
--- a/.github/workflows/shared-registry-push.yaml
+++ b/.github/workflows/shared-registry-push.yaml
@@ -95,6 +95,27 @@ jobs:
         continue-on-error: true
         run: echo "value=$(date -u +%Y%m%d%H%M)" >> "$GITHUB_OUTPUT"
 
+      # ARC runners build through the pod's rootless BuildKit sidecar ($BUILDKIT_HOST):
+      # no Docker daemon and nothing privileged. A non-ARC runner (the runner_label
+      # escape hatch) has no sidecar and gets buildx's default driver instead.
+      - name: Select the image builder
+        continue-on-error: true
+        id: builder
+        run: |
+          if [ -n "${BUILDKIT_HOST:-}" ]; then
+            echo "driver=remote" >> "$GITHUB_OUTPUT"
+            echo "endpoint=$BUILDKIT_HOST" >> "$GITHUB_OUTPUT"
+          else
+            echo "driver=docker-container" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Set up the image builder
+        continue-on-error: true
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver: ${{ steps.builder.outputs.driver }}
+          endpoint: ${{ steps.builder.outputs.endpoint }}
+
       - name: Build and push image to GCP Shared Registry
         id: build_push
         continue-on-error: true