diff --git a/.gitea/actions/buildkit-build-push/action.yaml b/.gitea/actions/buildkit-build-push/action.yaml
index ca148e7..097cbeb 100644
--- a/.gitea/actions/buildkit-build-push/action.yaml
+++ b/.gitea/actions/buildkit-build-push/action.yaml
@@ -31,19 +31,24 @@ runs:
     - name: Authenticate to Gitea registry
       shell: bash
       run: |
-        # Create a temporary file inside GITHUB_TEMP
-        DOCKER_CONFIG_FILE="${RUNNER_TEMP}/docker_config.json"
 
-        # Ensure cleanup ALWAYS happens
-        trap 'rm -f "$DOCKER_CONFIG_FILE"' EXIT
+        DOCKER_CONFIG_DIR="${RUNNER_TEMP}/.buildctl_docker"
+        mkdir -p "$DOCKER_CONFIG_DIR"
+
+        # clean up
+        trap 'rm -rf "$DOCKER_CONFIG_DIR"' EXIT
 
-        # Generate auth entry
         AUTH=$(printf "%s" "${{ inputs.registry_username }}:${{ inputs.registry_password }}" | base64 -w 0)
 
-        printf '{"auths":{"%s":{"auth":"%s"}}}' \
-          "${{ inputs.registry_addr }}" \
-          "$AUTH" \
-          > "$DOCKER_CONFIG_FILE"
+        cat > "$DOCKER_CONFIG_DIR/config.json" <<EOF
+        {
+          "auths": {
+            "${{ inputs.registry_addr }}": {
+              "auth": "$AUTH"
+            }
+          }
+        }
+        EOF
 
         # Run BuildKit build
         buildctl \
@@ -53,5 +58,6 @@ runs:
           --local context=${{ inputs.context }} \
           --local dockerfile=${{ inputs.dockerfile }} \
           --opt filename=Dockerfile \
-          --output type=image,name=${{ inputs.tags }},push=true,registry.config=$DOCKER_CONFIG_FILE
+          --output type=image,name=${{ inputs.tags }},push=true,registry.config=$DOCKER_CONFIG_DIR
+