diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 4932761..b6d61fd 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -5,40 +5,42 @@ on:
     branches:
       - master
 
+env:
+  REGISTRY: git.sal.giize.com
+  IMAGE_NAME: mozempk/insta-recipe
+
 jobs:
   test-and-build:
     runs-on: ubuntu-latest
+
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '24'
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run unit tests
-        run: npm test
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
+      - name: Run unit tests
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          target: tester
+          push: false
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
+
       - name: Log in to Gitea Container Registry
         uses: docker/login-action@v3
         with:
-          registry: git.sal.giize.com
-          username: ${{ secrets.REGISTRY_USER }}
-          password: ${{ secrets.REGISTRY_PASSWORD }}
+          registry: ${{ env.REGISTRY }}
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: .
           push: true
-          tags: git.sal.giize.com/mozempk/insta-recipe:latest
-          cache-from: type=registry,ref=git.sal.giize.com/mozempk/insta-recipe:buildcache
-          cache-to: type=registry,ref=git.sal.giize.com/mozempk/insta-recipe:buildcache,mode=max
+          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
+          platforms: linux/amd64
diff --git a/Dockerfile b/Dockerfile
index 189d9ab..a585258 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,21 @@
-FROM node:24-alpine
+# ── stage: tester ────────────────────────────────────────────────────────────
+FROM node:24-alpine AS tester
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci
+COPY . .
+RUN npm test
+
+# ── stage: builder ───────────────────────────────────────────────────────────
+FROM node:24-alpine AS builder
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci
+COPY . .
+RUN npm run build
+
+# ── stage: runner ────────────────────────────────────────────────────────────
+FROM node:24-alpine AS runner
 WORKDIR /app
 
 # Install yt-dlp (primary Instagram extractor) and Playwright system dependencies (fallback)
@@ -12,10 +29,8 @@ RUN apk add --no-cache \
     pip3 install --break-system-packages yt-dlp
 
 COPY package*.json ./
-RUN npm ci
-
-COPY . .
-RUN npm run build
+RUN npm ci --omit=dev
+COPY --from=builder /app/build ./build
 
 EXPOSE 3000
 ENV NODE_ENV=production