diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 6bd2f8f..8bc1eaa 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -3,29 +3,86 @@ on:
   push:
     branches:
       - main
+  workflow_dispatch:
 
 jobs:
   deploy:
     runs-on: native
-    timeout-minutes: 5
+    timeout-minutes: 10
+
     steps:
-      - name: Checkout
-        env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+      - name: Build and push image with BuildKit
         run: |
-          git clone https://sushi:${GITEA_TOKEN}@git.alocoq.fr/sushi/Camilou.fr.git .
+          kubectl -n ci delete job camilou-buildkit --ignore-not-found=true --wait=true
 
-      - name: Build & push image
-        run: |
-          docker build -t registry.alocoq.fr/sushi/camilou:${{ gitea.sha }} -t registry.alocoq.fr/sushi/camilou:latest .
-          docker push registry.alocoq.fr/sushi/camilou:${{ gitea.sha }}
-          docker push registry.alocoq.fr/sushi/camilou:latest
+          cat <<'EOF' | kubectl apply -f -
+          apiVersion: batch/v1
+          kind: Job
+          metadata:
+            name: camilou-buildkit
+            namespace: ci
+          spec:
+            backoffLimit: 0
+            template:
+              spec:
+                restartPolicy: Never
+                initContainers:
+                  - name: clone
+                    image: alpine/git:latest
+                    command: ["sh", "-c"]
+                    args:
+                      - |
+                        set -eux
+                        git clone --depth 1 https://sushi:$GITEA_TOKEN@git.alocoq.fr/sushi/Camilou.fr.git /workspace/repo
+                    env:
+                      - name: GITEA_TOKEN
+                        valueFrom:
+                          secretKeyRef:
+                            name: gitea-credentials
+                            key: token
+                    volumeMounts:
+                      - name: workspace
+                        mountPath: /workspace
 
-      - name: Install kubectl
+                containers:
+                  - name: buildkit
+                    image: moby/buildkit:latest
+                    securityContext:
+                      privileged: true
+                    command: ["sh", "-c"]
+                    args:
+                      - |
+                        set -eux
+                        REG=registry.git.svc.cluster.local:5000
+
+                        mkdir -p /etc/buildkit
+                        printf '[registry."%s"]\n  http = true\n  insecure = true\n' "$REG" > /etc/buildkit/buildkitd.toml
+
+                        buildctl-daemonless.sh build \
+                          --frontend=dockerfile.v0 \
+                          --local context=/workspace/repo \
+                          --local dockerfile=/workspace/repo \
+                          --import-cache type=registry,ref=$REG/camilou-cache:latest \
+                          --export-cache type=registry,ref=$REG/camilou-cache:latest,mode=max \
+                          --output type=image,name=$REG/camilou:latest,push=true,registry.insecure=true
+                    volumeMounts:
+                      - name: workspace
+                        mountPath: /workspace
+
+                volumes:
+                  - name: workspace
+                    emptyDir: {}
+          EOF
+
+      - name: Wait for build
         run: |
-          wget -q https://dl.k8s.io/release/v1.31.0/bin/linux/amd64/kubectl
-          chmod +x kubectl
-          mv kubectl /usr/local/bin/kubectl
+          kubectl -n ci wait --for=condition=complete job/camilou-buildkit --timeout=600s
+
+      - name: Show build logs
+        if: always()
+        run: |
+          kubectl -n ci logs job/camilou-buildkit -c clone || true
+          kubectl -n ci logs job/camilou-buildkit -c buildkit || true
 
       - name: Deploy
         env:
@@ -42,7 +99,13 @@ jobs:
             --user=deployer
           kubectl config use-context homelab
 
-          kubectl set image deployment/sushi \
-            nginx=registry.alocoq.fr/sushi/camilou:${{ gitea.sha }} \
-            -n sushi
-          kubectl rollout status deployment/sushi -n sushi --timeout=60s
\ No newline at end of file
+          kubectl -n sushi set image deployment/sushi \
+            nginx=registry.alocoq.fr/camilou:latest
+
+          kubectl -n sushi rollout restart deployment/sushi
+          kubectl -n sushi rollout status deployment/sushi --timeout=120s
+
+      - name: Cleanup
+        if: always()
+        run: |
+          kubectl -n ci delete job camilou-buildkit --ignore-not-found=true --wait=true
\ No newline at end of file