diff --git a/.gitea/workflows/docker-build-push.yml b/.gitea/workflows/docker-build-push.yml
index 859fc8f..ef31504 100644
--- a/.gitea/workflows/docker-build-push.yml
+++ b/.gitea/workflows/docker-build-push.yml
@@ -11,33 +11,32 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Build and push image via the admin host
+      # act_runner's job container ships docker+dockerd but doesn't start the
+      # daemon itself. This host's outer Docker uses overlay2, and overlay2
+      # can't nest inside overlay2 (BuildKit mount fails with "invalid
+      # argument"), so the inner daemon has to use vfs instead — slower, no
+      # layer dedup, but the only storage driver that actually works nested
+      # here.
+      - name: Start Docker daemon (vfs storage driver)
+        run: |
+          dockerd --storage-driver=vfs > /tmp/dockerd.log 2>&1 &
+          for i in $(seq 1 30); do
+            docker info >/dev/null 2>&1 && break
+            sleep 1
+          done
+          docker info >/dev/null 2>&1 || { cat /tmp/dockerd.log; exit 1; }
+
+      - name: Build and push image
         env:
-          ADMIN_HOST_SSH_KEY: ${{ secrets.ADMIN_HOST_SSH_KEY }}
           REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
-          mkdir -p ~/.ssh
-          printf '%s\n' "$ADMIN_HOST_SSH_KEY" > ~/.ssh/id_ed25519
-          chmod 600 ~/.ssh/id_ed25519
-          ssh-keyscan -H host.docker.internal >> ~/.ssh/known_hosts 2>/dev/null
-
           SHA="${{ github.sha }}"
-          REMOTE_DIR="/tmp/ci-yttrx-welcomebot-$SHA"
           IMAGE="gitea.blairhaus.net/pmb/yttrx-welcomebot"
 
-          tar czf - --exclude=.git . | ssh -i ~/.ssh/id_ed25519 pmb@host.docker.internal \
-            "mkdir -p $REMOTE_DIR && tar xzf - -C $REMOTE_DIR"
-
-          ssh -i ~/.ssh/id_ed25519 pmb@host.docker.internal bash -s <<EOF
-          set -euo pipefail
-          cd "$REMOTE_DIR"
-          echo "==> [host] building $IMAGE:$SHA"
           docker build -t "$IMAGE:$SHA" -t "$IMAGE:latest" .
           printf '%s' "$REGISTRY_TOKEN" | docker login gitea.blairhaus.net -u pmb --password-stdin
           docker push "$IMAGE:$SHA"
           docker push "$IMAGE:latest"
           docker logout gitea.blairhaus.net
-          rm -rf "$REMOTE_DIR"
-          EOF
 
           echo "pushed $IMAGE:$SHA and $IMAGE:latest"