diff --git a/.gitea/workflows/server-docker-build.yml b/.gitea/workflows/server-docker-build.yml
index 0b52425..3717cec 100644
--- a/.gitea/workflows/server-docker-build.yml
+++ b/.gitea/workflows/server-docker-build.yml
@@ -16,6 +16,22 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
+        with:
+          # 10.0.0.246:3000 is plain HTTP (a bare LAN IP:port, no TLS cert
+          # would validate for it), but BuildKit defaults to HTTPS for any
+          # registry that isn't docker.io. This tells BuildKit specifically
+          # to skip that for this one host. NOTE: this only covers the
+          # actual build+push (BuildKit). The "Log in" step below runs a
+          # plain `docker login`, which goes through the classic Docker
+          # CLI/daemon instead of BuildKit and does NOT read this config --
+          # that one only works once the Docker daemon backing this runner
+          # has 10.0.0.246:3000 listed under "insecure-registries" in its
+          # own /etc/docker/daemon.json (then `systemctl restart docker`).
+          # That's runner-host infrastructure this repo can't configure.
+          config-inline: |
+            [registry."10.0.0.246:3000"]
+              http = true
+              insecure = true
 
       - name: Log in to local Gitea Container Registry
         uses: docker/login-action@v3