diff --git a/.forgejo/workflows/build.yaml b/.gitea/workflows/build.yaml
similarity index 79%
rename from .forgejo/workflows/build.yaml
rename to .gitea/workflows/build.yaml
index 5c61f86..39070ea 100644
--- a/.forgejo/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -1,13 +1,15 @@
+name: test
+
 on: push
 
 jobs:
   build:
+    name: test
     runs-on: debian
     steps:
       - uses: actions/checkout@v1
-      - uses: actions/buildkit@v1
+      - uses: actions/kaniko@v1
         with:
           dockerfile: debian/Dockerfile
           image: actions/debian:latest
           password: "${{ secrets.PKGRW }}"
-          cache: false
diff --git a/debian/Dockerfile b/debian/Dockerfile
index 0120f18..0b169e1 100644
--- a/debian/Dockerfile
+++ b/debian/Dockerfile
@@ -1,16 +1,19 @@
-FROM docker.io/debian:trixie-20250929-slim
-ENV DEBIAN_FRONTEND=noninteractive
+FROM debian:12-slim as kubectl
 RUN apt-get update && apt-get install -y --no-install-recommends \
         ca-certificates \
         curl \
+        git \
+    && rm -rf /var/lib/apt/lists/*
+ENV K8S_VERSION=v1.27
+RUN V="$(git ls-remote --tags --refs --sort=version:refname https://github.com/kubernetes/kubernetes "$K8S_VERSION.*" | awk -F/ 'END{print $NF}')" \
+    && curl -Lo /kubectl "https://dl.k8s.io/release/$V/bin/linux/amd64/kubectl"
+
+FROM debian:12-slim
+ENV DEBIAN_FRONTEND=noninteractive
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        ca-certificates \
         gettext-base \
         git \
-        openssh-client \
-        yq \
+        jq \
     && rm -rf /var/lib/apt/lists/*
-# https://dl.k8s.io/release/stable.txt
-RUN curl -sLo /usr/local/bin/kubectl \
-        "https://dl.k8s.io/release/v1.34.1/bin/linux/amd64/kubectl" \
-    && chmod 0755 /usr/local/bin/kubectl
-RUN useradd -m app
-USER app
+COPY --from=kubectl --chmod=0755 /kubectl /usr/local/bin/