diff --git a/.gitea/workflows/publish-images.yml b/.gitea/workflows/publish-images.yml
index 70033c7..5d9094e 100644
--- a/.gitea/workflows/publish-images.yml
+++ b/.gitea/workflows/publish-images.yml
@@ -74,8 +74,10 @@ jobs:
           image_tag="sha-${GITHUB_SHA}"
           docker_config=$(mktemp -d)
           jwt_file=$(mktemp)
+          buildkit_config=$(mktemp)
           cleanup() {
-            rm -rf -- "$docker_config" "$jwt_file"
+            docker buildx rm ci-builder >/dev/null 2>&1 || true
+            rm -rf -- "$docker_config" "$jwt_file" "$buildkit_config"
           }
           trap cleanup EXIT
           export DOCKER_CONFIG="$docker_config"
@@ -88,12 +90,25 @@ jobs:
           jq -er '.[0].svids[0].svid' "$jwt_file" | \
             docker login "$PUSH_REGISTRY" --username zot --password-stdin
 
+          # The docker driver cannot publish attestations. Use an isolated
+          # BuildKit worker, but force its snapshotter to copy-based native so
+          # it does not attempt nested overlay mounts inside the runner Pod.
+          printf '%s\n' \
+            '[worker.oci]' \
+            '  snapshotter = "native"' \
+            >"$buildkit_config"
+          docker buildx create \
+            --name ci-builder \
+            --driver docker-container \
+            --buildkitd-config "$buildkit_config" \
+            --use
+
           publish() {
             local repository=$1
             local dockerfile=$2
             local metadata=$3
             docker buildx build \
-              --builder default \
+              --builder ci-builder \
               --platform linux/amd64 \
               --file "$dockerfile" \
               --tag "${PUSH_REGISTRY}/${repository}:${image_tag}" \