diff --git a/.gitea/workflows/publish.yml b/.gitea/workflows/publish.yml
index 210dee6..6536128 100644
--- a/.gitea/workflows/publish.yml
+++ b/.gitea/workflows/publish.yml
@@ -9,8 +9,10 @@ env:
   IMAGE_NAME: gt.uo1.net/1movmedia/ollama-with-model
 
 jobs:
-  publish:
+  build:
     runs-on: ubuntu-latest
+    outputs:
+      digest: ${{ steps.build.outputs.digest }}
     steps:
       - uses: actions/checkout@v4
 
@@ -24,9 +26,47 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
-      - name: Build and publish
+      - name: Build image
+        id: build
         uses: docker/build-push-action@v7
         with:
           context: .
-          push: true
-          tags: ${{ env.IMAGE_NAME }}:latest
+          outputs: type=image,name=${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true
+
+  publish:
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - name: Log in to Gitea registry
+        uses: docker/login-action@v3
+        with:
+          registry: gt.uo1.net
+          username: ${{ vars.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Publish latest tag
+        run: docker buildx imagetools create --tag "${IMAGE_NAME}:latest" "${IMAGE_NAME}@${{ needs.build.outputs.digest }}"
+
+      - name: Remove old image versions
+        env:
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -eu
+          command -v jq >/dev/null
+          api='https://gt.uo1.net/api/v1/packages/1movmedia/container/ollama-with-model'
+          while :; do
+            response=$(curl --fail --silent --show-error \
+              --header "Authorization: token ${REGISTRY_TOKEN}" \
+              "${api}?page=1&limit=100")
+            versions=$(printf '%s\n' "$response" \
+              | jq --raw-output '.[] | select(.version != "latest") | .version')
+            [ -n "$versions" ] || break
+            printf '%s\n' "$versions" | while IFS= read -r version; do
+              curl --fail --silent --show-error --request DELETE \
+                --header "Authorization: token ${REGISTRY_TOKEN}" \
+                "${api}/${version}"
+            done
+          done
diff --git a/README.md b/README.md
index 1f9ba8b..7a33dd2 100644
--- a/README.md
+++ b/README.md
@@ -46,7 +46,7 @@ Building downloads the complete model, so the runner needs enough disk space for
 
 ## Publish from Gitea Actions
 
-The workflow in `.gitea/workflows/publish.yml` builds and publishes the `latest` tag on pushes to `main`. It can also be started manually with `workflow_dispatch`.
+The workflow in `.gitea/workflows/publish.yml` builds the image by digest, then publishes the `latest` tag in a separate job. After a successful publication, it removes every other version of the image from the Gitea registry. It runs on pushes to `main` and can also be started manually with `workflow_dispatch`.
 
 Configure the following repository Actions variable and secret before running it: