diff --git a/.gitea/actions/buildkit-build-push/action.yaml b/.gitea/actions/buildkit-build-push/action.yaml
index 097cbeb..f7ba33c 100644
--- a/.gitea/actions/buildkit-build-push/action.yaml
+++ b/.gitea/actions/buildkit-build-push/action.yaml
@@ -50,6 +50,18 @@ runs:
         }
         EOF
 
+        echo "Checking config.json (safe output):"
+        if [ ! -f "$DOCKER_CONFIG_DIR/config.json" ]; then
+          echo "ERROR: config.json missing"
+          exit 1
+        fi
+
+        jq '
+          .auths |= with_entries(
+            .value.auth = "***MASKED***"
+          )
+        ' "$DOCKER_CONFIG_DIR/config.json"
+
         # Run BuildKit build
         buildctl \
           --addr ${{ inputs.buildkit_addr }} \