diff --git a/.forgejo/workflows/production.yaml b/.forgejo/workflows/production.yaml
index 93117f5c..c842be5c 100644
--- a/.forgejo/workflows/production.yaml
+++ b/.forgejo/workflows/production.yaml
@@ -100,32 +100,35 @@ jobs:
           echo "tag=${TAG}" >> $GITHUB_OUTPUT
           echo "Full image tag: ${TAG}"
 
-      - name: Install Podman
+      - name: Install img
         run: |
-          sudo apt-get update
-          sudo apt-get install -y podman
+          curl -fsSL https://github.com/genuinetools/img/releases/download/v0.5.11/img-linux-amd64 -o /tmp/img
+          sudo install /tmp/img /usr/local/bin/img
+          rm /tmp/img
 
-      - name: Build and push with Podman
+      - name: Build and push with img
         run: |
           IMAGE_TAG="${{ steps.tag.outputs.tag }}"
 
-          # Build with chroot isolation (no namespaces required)
-          podman build \
-            --isolation=chroot \
+          # Build with img (completely unprivileged, no capabilities needed)
+          img build \
             --build-arg MIX_ENV=prod \
             --file k8s/Dockerfile \
             --tag "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}" \
-            --tag "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production" \
             .
 
-          # Login and push both tags
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | podman login \
-            --username "${{ secrets.REGISTRY_USER }}" \
-            --password-stdin \
+          # Login and push
+          img login \
+            -u "${{ secrets.REGISTRY_USER }}" \
+            -p "${{ secrets.REGISTRY_PASSWORD }}" \
             "${{ secrets.REGISTRY_URL }}"
 
-          podman push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}"
-          podman push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production"
+          img push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}"
+
+          # Tag and push production
+          img tag "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}" \
+                  "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production"
+          img push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production"
 
   update-manifest:
     name: Update Deployment Manifest