diff --git a/.gitea/workflows/publish.yaml b/.gitea/workflows/publish.yaml
index 683ca03..b70c517 100644
--- a/.gitea/workflows/publish.yaml
+++ b/.gitea/workflows/publish.yaml
@@ -17,7 +17,7 @@ jobs:
           # TODO - when https://github.com/go-gitea/gitea/pull/33945 is merged, instead use per-workflow OIDC-based auth
           role: act-runner-helm-charts
           secrets: |
-            shared-secrets/data/gitea/pat_to_push_images token | GITEA_TOKEN
+            shared-secrets/data/gitea/pat_for_total_access token | GITEA_TOKEN
 
       - name: Login to Gitea
         uses: docker/login-action@v3
@@ -38,6 +38,9 @@ jobs:
       - name: Build and push image
         uses: docker/build-push-action@v3
         with:
+          cache-from: type=registry,ref=gitea.scubbo.org/scubbo/edh-elo:latest
+          # https://github.com/go-gitea/gitea/issues/28973#issuecomment-1961859655
+          cache-to: mode=max,image-manifest=true,oci-mediatypes=true,type=registry,ref=gitea.scubbo.org/scubbo/edh-elo:latest
           context: .
           file: Dockerfile
           target: prod
@@ -51,15 +54,22 @@ jobs:
         run: |
           echo "Image pushed: gitea.scubbo.org/scubbo/edh-elo:${{ gitea.sha }}"
 
+      - name: Checkout Helm Chart
+        uses: actions/checkout@v3
+        with:
+          repository: scubbo/helm-charts
+          path: helm-charts
+          github-server-url: http://gitea-http:3000
+          token: ${{ env.GITEA_TOKEN }}
+          ref: main
+
       - name: Update Helm Chart
-        env:
-          GITEA_PASSWORD: ${{ env.GITEA_TOKEN }}
         run: |
-          git clone https://scubbo:${GITEA_PASSWORD}@gitea.scubbo.org/scubbo/helm-charts.git
           cd helm-charts
           yq -i '.image.tag = "${{ gitea.sha }}"' charts/edh-elo/values.yaml
           git add -A
           git -c user.name="Imagebot" -c user.email="fake@scubbo.org" commit -m 'Update EDH ELO commit to "${{ gitea.sha }}"'
-          git push origin main:main
-          cd ...
+          git remote add origin-with-credentials http://scubbo:${GITEA_TOKEN}@gitea-http:3000/scubbo/helm-charts.git
+          git push origin-with-credentials main:main
+          cd ..
           rm -rf helm-charts