diff --git a/.woodpecker/ci.yaml b/.woodpecker/ci.yaml
index 735ac1e..f101b87 100644
--- a/.woodpecker/ci.yaml
+++ b/.woodpecker/ci.yaml
@@ -2,12 +2,11 @@
 #
 # Required secrets (Repository settings -> Secrets):
 #   registry_username, registry_password
-# The repo must be marked "Trusted" (docker-buildx plugin runs privileged),
-# or switch the publish steps to woodpeckerci/plugin-kaniko.
+# Images are built with kaniko: no privileged mode / Trusted flag needed.
 #
 variables:
   - &node_image 'node:22-alpine'
-  - &buildx 'woodpeckerci/plugin-docker-buildx:latest'
+  - &kaniko 'woodpeckerci/plugin-kaniko:latest'
   - &registry 'git.aggtaa.com'
   - &publish_when
     - event: push
@@ -25,11 +24,11 @@ steps:
       - event: [push, pull_request]
 
   - name: image-server-be
-    image: *buildx
+    image: *kaniko
     depends_on: [check]
     settings:
       registry: *registry
-      repo: git.aggtaa.com/${CI_REPO_OWNER}/cardy-server-be
+      repo: ${CI_REPO_OWNER}/cardy-server-be
       dockerfile: docker/server-be.Dockerfile
       context: .
       tags: ['${CI_COMMIT_SHA:0:8}', '${CI_COMMIT_BRANCH}']
@@ -40,11 +39,11 @@ steps:
     when: *publish_when
 
   - name: image-server-fe
-    image: *buildx
+    image: *kaniko
     depends_on: [check]
     settings:
       registry: *registry
-      repo: git.aggtaa.com/${CI_REPO_OWNER}/cardy-server-fe
+      repo: ${CI_REPO_OWNER}/cardy-server-fe
       dockerfile: docker/server-fe.Dockerfile
       context: .
       tags: ['${CI_COMMIT_SHA:0:8}', '${CI_COMMIT_BRANCH}']
@@ -55,11 +54,11 @@ steps:
     when: *publish_when
 
   - name: image-mobile-client
-    image: *buildx
+    image: *kaniko
     depends_on: [check]
     settings:
       registry: *registry
-      repo: git.aggtaa.com/${CI_REPO_OWNER}/cardy-mobile-client
+      repo: ${CI_REPO_OWNER}/cardy-mobile-client
       dockerfile: docker/mobile-client.Dockerfile
       context: .
       tags: ['${CI_COMMIT_SHA:0:8}', '${CI_COMMIT_BRANCH}']
diff --git a/README.md b/README.md
index 9026448..2a12923 100644
--- a/README.md
+++ b/README.md
@@ -109,5 +109,5 @@ pnpm typecheck
 
 `.woodpecker/ci.yaml`: typecheck + tests on every push/PR, then images are pushed on `main` and `ci`
 (tags: short commit SHA and branch name, e.g. `:main`). Images go to the Gitea registry (`git.aggtaa.com/anton/cardy-*`); add secrets `registry_username`
-(Gitea user + access token with `write:package`) and `registry_password`, and mark the repository as Trusted (buildx plugin is privileged).
+(Gitea user + access token with `write:package`) and `registry_password`. Images are built with kaniko, so the repository doesn't need to be Trusted.
 `docker/compose.example.yml` shows how to run the images. APK/OTA publishing stays local (needs the signing key).