diff --git a/.gitea/workflows/tag_release.yml b/.gitea/workflows/tag_release.yml
index b2244a4..8452e74 100644
--- a/.gitea/workflows/tag_release.yml
+++ b/.gitea/workflows/tag_release.yml
@@ -7,78 +7,65 @@ on:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-java17
 
     steps:
       # 1. Checkout the code
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
 
-      # 2. Set up Java and Maven
-      - name: Set up JDK (Eclipse Temurin)
-        uses: actions/setup-java@v3
-        with:
-          distribution: "temurin"
-          java-version: "17"
-          cache: maven
-
-      # 3. Verify Maven installation
-      - name: Install Maven
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y maven
-          mvn -version
-
-      # 4. Build the Spring Boot application
+      # 2. Build the Spring Boot application using the Maven wrapper
+      #    (Java 17 is pre-installed in the runner image)
       - name: Build Spring Boot Application
-        run: |
-          mvn clean package -DskipTests
+        run: ./mvnw clean package -DskipTests
 
-      # 5. Set up Docker
-      - name: Set up Docker
+      # 3. Derive version tags from the pushed git tag
+      #    e.g. 1.1.0 -> tag_version=1.1.0, minor=1.1, major=1
+      - name: Extract version tags
+        id: ver
         run: |
-          docker --version
-
-      # 6. Extract the tag name
-      - name: Extract Tag Version
-        id: extract_version
-        run: |
-          TAG_VERSION=$(echo "${GITHUB_REF}" | sed 's#refs/tags/##')
+          TAG_VERSION="${{ github.ref_name }}"
           if [ -z "$TAG_VERSION" ]; then
             echo "Error: TAG_VERSION is empty."
             exit 1
           fi
-          echo "TAG_VERSION=$TAG_VERSION" >> $GITHUB_ENV
+          MINOR_VERSION=$(echo "$TAG_VERSION" | cut -d. -f1,2)
+          MAJOR_VERSION=$(echo "$TAG_VERSION" | cut -d. -f1)
+          echo "tag_version=$TAG_VERSION" >> "$GITHUB_OUTPUT"
+          echo "minor=$MINOR_VERSION"     >> "$GITHUB_OUTPUT"
+          echo "major=$MAJOR_VERSION"     >> "$GITHUB_OUTPUT"
 
-          # Extract major and minor versions
-          MAJOR_VERSION=$(echo "${TAG_VERSION}" | cut -d. -f1)
-          MINOR_VERSION=$(echo "${TAG_VERSION}" | cut -d. -f1,2)
-          echo "MAJOR_VERSION=$MAJOR_VERSION" >> $GITHUB_ENV
-          echo "MINOR_VERSION=$MINOR_VERSION" >> $GITHUB_ENV
+      # 4. Set up Docker Buildx (enables layer caching)
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
 
-      # 7. Build the Docker image with the tag
-      - name: Build and Package Docker Image
-        run: |
-          docker build -t tea.zendric.de/cedric/xpensely-server:${{ env.TAG_VERSION }} .
+      # 5. Login to Docker Hub to avoid base-image pull rate limits
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USER }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      # 8. Tag the image with Major Version (e.g., 0)
-      - name: Tag with Major Version
-        run: |
-          docker tag tea.zendric.de/cedric/xpensely-server:${{ env.TAG_VERSION }} tea.zendric.de/cedric/xpensely-server:${{ env.MAJOR_VERSION }}
-
-      # 9. Tag the image with Minor Version (e.g., 0.1)
-      - name: Tag with Minor Version
-        run: |
-          docker tag tea.zendric.de/cedric/xpensely-server:${{ env.TAG_VERSION }} tea.zendric.de/cedric/xpensely-server:${{ env.MINOR_VERSION }}
-
-      # 10. Docker login
+      # 6. Login to the Gitea registry
       - name: Login to Docker Registry
-        run: |
-          echo "${{ secrets.TEAPASSWORD }}" | docker login tea.zendric.de -u ${{ secrets.TEAUSER }} --password-stdin
+        uses: docker/login-action@v3
+        with:
+          registry: tea.zendric.de
+          username: ${{ secrets.TEAUSER }}
+          password: ${{ secrets.TEAPASSWORD }}
 
-      # 11. Push the Docker images with the tags
-      - name: Push the Docker Image to registry
-        run: |
-          docker push tea.zendric.de/cedric/xpensely-server:${{ env.TAG_VERSION }}
-          docker push tea.zendric.de/cedric/xpensely-server:${{ env.MAJOR_VERSION }}
-          docker push tea.zendric.de/cedric/xpensely-server:${{ env.MINOR_VERSION }}
+      # 7. Build and push the versioned Docker images with layer caching.
+      #    Pushes exact, minor, and major tags. The prod compose references
+      #    the major tag (":1"), so pushing here makes the new build available
+      #    to pull in Dockge — deploy is triggered MANUALLY after the DB migration.
+      - name: Build and Push Docker Image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: |
+            tea.zendric.de/cedric/xpensely-server:${{ steps.ver.outputs.tag_version }}
+            tea.zendric.de/cedric/xpensely-server:${{ steps.ver.outputs.minor }}
+            tea.zendric.de/cedric/xpensely-server:${{ steps.ver.outputs.major }}
+          cache-from: type=registry,ref=tea.zendric.de/cedric/xpensely-server:buildcache
+          cache-to: type=registry,ref=tea.zendric.de/cedric/xpensely-server:buildcache,mode=max