diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index b5c7468..da6e13a 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -28,50 +28,34 @@ jobs:
       - name: Hugo Build
         run: hugo --minify
 
-      - name: Install Podman
+      - name: Install Buildah
         run: |
           apt-get update -qq
-          apt-get install -y -qq podman fuse-overlayfs
-          # Configure Podman for Gitea Registry
-          mkdir -p /etc/containers/registries.conf.d
-          cat > /etc/containers/registries.conf.d/gitea-registry.conf <<REGCFG
-          [[registry]]
-          location = "${{ env.REGISTRY }}"
-          insecure = true
-          REGCFG
+          apt-get install -y -qq buildah fuse-overlayfs uidmap
+          # Configure storage
+          mkdir -p /root/.local/share/containers
+          buildah version
 
-      - name: Build and Push with Podman
+      - name: Build and Push with Buildah
         env:
           REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
           # Login to Gitea Registry
           echo "$REGISTRY_TOKEN" | \
-            podman login ${{ env.REGISTRY }} -u luochen570 --password-stdin
+            buildah login ${{ env.REGISTRY }} -u luochen570 --password-stdin
 
-          # Build image (daemonless!)
-          podman build -t ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ github.sha }} .
-          podman tag ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ github.sha }} \
+          # Build container image (daemonless!)
+          buildah bud -t ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ github.sha }} .
+
+          # Push to registry
+          buildah push ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ github.sha }}
+          # Also tag as latest
+          buildah tag ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ github.sha }} \
             ${{ env.REGISTRY }}/${{ env.IMAGE }}:latest
-
-          # Push
-          podman push ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ github.sha }}
-          podman push ${{ env.REGISTRY }}/${{ env.IMAGE }}:latest
+          buildah push ${{ env.REGISTRY }}/${{ env.IMAGE }}:latest
 
       - name: Deploy to k3s
-        env:
-          KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
         run: |
-          # Decode kubeconfig
-          echo "$KUBECONFIG_B64" | base64 -d > /tmp/kubeconfig.json
-
-          # Download kubectl
-          curl -fsSLO "https://dl.k8s.io/release/v1.32.0/bin/linux/amd64/kubectl"
-          chmod +x kubectl
-
-          # Rollout new image
-          ./kubectl --kubeconfig /tmp/kubeconfig.json \
-            set image deployment/hugo-blog -n hugo \
-            nginx=${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ github.sha }}
-
-          ./kubectl --kubeconfig /tmp/kubeconfig.json \
-            rollout status deployment/hugo-blog -n hugo --timeout=120s
+          echo "kubectl deploy - skip for now, need runner kubectl access"
+          # kubectl set image deployment/hugo-blog -n hugo \
+          #   nginx=${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ github.sha }}