diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b118702..33172fb 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -36,94 +36,89 @@ jobs:
           # Filter to only directories that contain a Dockerfile (real lanes)
           FILTERED_LANES=()
           SKIPPED_LANES=()
-          for _d in "${ALL_LANES[@]}"; do
-            if [[ -f "${_d}/Dockerfile" ]]; then
-              FILTERED_LANES+=("${_d}")
-            else
-              SKIPPED_LANES+=("${_d}")
-            fi
-          done
-          ALL_LANES=("${FILTERED_LANES[@]}")
+          build:
+            needs: plan
+            if: needs.plan.outputs.should_build == 'true'
+            runs-on: ubuntu-latest
+            steps:
+              - uses: actions/checkout@v4
 
-          # Also capture lane basenames (e.g. '7.4', 'nginx') for stable naming
-          ALL_NAMES=()
-          for _d in "${ALL_LANES[@]}"; do
-            ALL_NAMES+=("$(basename "${_d}")")
-          done
-          if [[ ${#ALL_LANES[@]} -eq 0 ]]; then
-            echo "No lanes found under docker/. Nothing to do."
-            echo "should_build=false" >> $GITHUB_OUTPUT
-            echo 'matrix={"dir":[]}' >> $GITHUB_OUTPUT
-            exit 0
-          fi
+              - uses: docker/setup-buildx-action@v3
 
-          # Determine changed files (PR vs push vs manual dispatch)
-          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-            BASE_SHA="${{ github.event.pull_request.base.sha }}"
-            HEAD_SHA="${{ github.event.pull_request.head.sha }}"
-          elif [[ "${{ github.event_name }}" == "push" ]]; then
-            # For push events try to get the previous commit; fall back to empty
-            BASE_SHA="$(git rev-parse HEAD~1 2>/dev/null || true)"
-            HEAD_SHA="$(git rev-parse HEAD 2>/dev/null || true)"
-          else
-            # For workflow_dispatch and other events treat as "all files changed"
-            BASE_SHA=""
-            HEAD_SHA="$(git rev-parse HEAD 2>/dev/null || true)"
-          fi
+              - name: DEBUG registry username source
+                run: |
+                  echo "Selected registry username source: $SOURCE"
+                env:
+                  SOURCE: ${{ inputs.REGISTRY_USER != '' && 'inputs' || secrets.REGISTRY_USER != '' && 'secrets' || vars.REGISTRY_USER != '' && 'vars' || 'actor' }}
 
-          if [[ -n "$BASE_SHA" ]]; then
-            CHANGED=$(git diff --name-only "$BASE_SHA" "$HEAD_SHA")
-          else
-            # First commit or shallow: treat everything as changed
-            CHANGED=$(git ls-files)
-          fi
+              - uses: docker/login-action@v3
+                with:
+                  registry: gitea.auvem.com
+                  username: ${{ inputs.REGISTRY_USER != '' && inputs.REGISTRY_USER || secrets.REGISTRY_USER != '' && secrets.REGISTRY_USER || vars.REGISTRY_USER != '' && vars.REGISTRY_USER || github.actor }}
+                  password: ${{ secrets.REGISTRY_TOKEN }}
 
-          echo "Changed files:"
-          echo "$CHANGED"
+              - name: Show plan matrix
+                run: |
+                  echo "Plan matrix: $MATRIX_JSON"
+                  jq -C . dir <<< "$MATRIX_JSON" 2>/dev/null || true
+                env:
+                  MATRIX_JSON: ${{ needs.plan.outputs.matrix }}
 
-          # If workflow changed, rebuild all lanes (use basenames)
-          if grep -qx ".github/workflows/build.yml" <<< "$CHANGED"; then
-            echo "Workflow changed; rebuilding all lanes."
-            # Use full lane paths (e.g. 'docker/7.4') so downstream steps get deterministic dirs
-            TARGET_DIRS=("${ALL_LANES[@]}")
-          else
-            # Build only lanes with changes under their directories
-            TARGET_DIRS=()
-            for idx in "${!ALL_LANES[@]}"; do
-              lane_path="${ALL_LANES[$idx]}"
-              lane_name="${ALL_NAMES[$idx]}"
-              # Any change directly under lane dir counts; include Dockerfile or subpaths
-              if grep -q "^${lane_path}/" <<< "$CHANGED"; then
-                # Append the full lane path (e.g. 'docker/7.4')
-                TARGET_DIRS+=("${lane_path}")
-              fi
-            done
-          fi
+              - name: Loop: build and push per-lane
+                shell: bash
+                env:
+                  MATRIX_JSON: ${{ needs.plan.outputs.matrix }}
+                  GIT_SHA_SHORT: ${GITHUB_SHA::7}
+                run: |
+                  set -euo pipefail
 
-          # De-duplicate
-          mapfile -t TARGET_DIRS < <(printf "%s\n" "${TARGET_DIRS[@]}" | awk 'NF && !x[$0]++')
+                  if [[ -z "$MATRIX_JSON" ]]; then
+                    echo "ERROR: plan matrix is empty. Aborting." >&2
+                    exit 1
+                  fi
 
-          # Diagnostics: show what we will include in the matrix
-          echo "ALL_LANES (discovered):"
-          for i in "${!ALL_LANES[@]}"; do
-            printf "  [%d] '%s'\n" "$i" "${ALL_LANES[$i]}"
-          done
+                  # Iterate lanes
+                  lanes=$(jq -r '.dir[]' <<< "$MATRIX_JSON")
+                  echo "Lanes to build:"
+                  echo "$lanes"
 
-          echo "TARGET_DIRS (after selection & dedupe):"
-          for i in "${!TARGET_DIRS[@]}"; do
-            # Show non-printable/empty clearly
-            printf "  [%d] '%s' (len=%d)\n" "$i" "${TARGET_DIRS[$i]}" "${#TARGET_DIRS[$i]}"
-          done
+                  for lane in $lanes; do
+                    echo "\n--- Building lane: $lane ---"
+                    if [[ ! -f "$lane/Dockerfile" ]]; then
+                      echo "ERROR: No Dockerfile at $lane/Dockerfile" >&2
+                      exit 1
+                    fi
 
-          # Fail if any empty entries sneaked in; that would cause ambiguous matrix entries
-          for val in "${TARGET_DIRS[@]}"; do
-            if [[ -z "${val}" ]]; then
-              echo "ERROR: Computed target dirs contains an empty entry. Aborting to avoid ambiguous matrix." >&2
-              exit 1
-            fi
-          done
+                    NAME=$(basename "$lane")
 
-          if [[ ${#TARGET_DIRS[@]} -eq 0 ]]; then
+                    if [[ "$NAME" == "nginx" ]]; then
+                      IMAGE="gitea.auvem.com/auvem/wordpress-docker/nginx"
+                      TAG="stable"
+                    else
+                      IMAGE="gitea.auvem.com/auvem/wordpress-docker/php-fpm"
+                      if [[ "$NAME" =~ ^([0-9]+\.[0-9]+)$ ]]; then
+                        VERSION="${BASH_REMATCH[1]}"
+                        TAG="${VERSION}-stable"
+                      elif [[ "$NAME" =~ ^([0-9]+)$ ]]; then
+                        VERSION="${BASH_REMATCH[1]}"
+                        TAG="${VERSION}-stable"
+                      else
+                        echo "ERROR: Cannot deterministically derive a version tag from lane name '$NAME'." >&2
+                        exit 1
+                      fi
+                    fi
+
+                    echo "Computed: lane='$lane' name='$NAME' image='$IMAGE' tags='$IMAGE:${TAG},$IMAGE:git-${GIT_SHA_SHORT}'"
+
+                    # Buildx build and push
+                    docker buildx build \
+                      --push \
+                      --platform linux/amd64 \
+                      --tag "$IMAGE:${TAG}" \
+                      --tag "$IMAGE:git-${GIT_SHA_SHORT}" \
+                      --file "$lane/Dockerfile" \
+                      .
+                  done
             echo "No lane directories changed. Skipping build."
             echo "should_build=false" >> $GITHUB_OUTPUT
             echo 'matrix={"dir":[]}' >> $GITHUB_OUTPUT