diff --git a/.gitea/workflows/build-image.yml b/.gitea/workflows/build-image.yml
index 16db2d5..e5e6a93 100644
--- a/.gitea/workflows/build-image.yml
+++ b/.gitea/workflows/build-image.yml
@@ -11,9 +11,10 @@ jobs:
   build:
     runs-on: ubuntu-latest
     container:
-      # Daemonless image builder; :debug variant ships a busybox shell so
-      # act can exec steps inside it. No docker socket, no privileges.
-      image: gcr.io/kaniko-project/executor:v1.23.2-debug
+      # Daemonless image builder: kaniko :debug plus the /bin/sleep symlink
+      # act needs for job-container PID 1 (see ci/Dockerfile.kaniko-act).
+      # No docker socket, no privileges.
+      image: pi5-16.local:3005/mikkeli/kaniko-act:v1.23.2
 
     steps:
       - name: Fetch source, build, push
diff --git a/ci/Dockerfile.kaniko-act b/ci/Dockerfile.kaniko-act
new file mode 100644
index 0000000..3cb63b7
--- /dev/null
+++ b/ci/Dockerfile.kaniko-act
@@ -0,0 +1,13 @@
+# Kaniko executor adapted for Gitea act_runner job containers.
+#
+# act starts job containers with entrypoint /bin/sleep; kaniko's image
+# already symlinks /bin/sh -> /busybox/sh but ships no /bin/sleep.
+# This wrapper adds that one symlink. Nothing else changes.
+#
+# Bootstrap: the first build of this image is done manually on the host
+# (docker build -f ci/Dockerfile.kaniko-act -t <registry>/mikkeli/kaniko-act:<ver> .)
+# because no builder image exists yet. Later version bumps can be built by
+# the build-image workflow itself, using the previous kaniko-act.
+FROM gcr.io/kaniko-project/executor:v1.23.2-debug
+SHELL ["/busybox/sh", "-c"]
+RUN ln -sf /busybox/sleep /bin/sleep