diff --git a/.gitea/workflows/build-docker-images.yml b/.gitea/workflows/build-docker-images.yml
index 0a96a41..0ff849e 100644
--- a/.gitea/workflows/build-docker-images.yml
+++ b/.gitea/workflows/build-docker-images.yml
@@ -98,99 +98,11 @@ jobs:
             && echo "NetBird management connected." \
             || { echo "::error title=NetBird not connected::Management not connected after netbird up."; exit 1; }
 
-      - name: Install kubectl
-        uses: azure/setup-kubectl@v4
+      - name: Deploy to talos-prod
+        env:
+          KUBE_CONFIG: ${{ secrets.KUBE_CONFIG }}
         with:
-          version: 'v1.36.2'
-
-      - name: Configure Kubernetes CA
-        env:
-          KUBE_CA_B64: ${{ secrets.KUBE_CA_B64 }}
-        run: |
-          set -euo pipefail
-
-          printf '%s' "$KUBE_CA_B64" \
-            | base64 -d \
-            > "${RUNNER_TEMP}/kubernetes-ca.crt"
-
-          chmod 600 "${RUNNER_TEMP}/kubernetes-ca.crt"
-
-          echo "KUBE_CA=${RUNNER_TEMP}/kubernetes-ca.crt" >> "$GITHUB_ENV"
-
-      - name: Verify Kubernetes access
-        env:
-          KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }}
-        run: |
-          set -euo pipefail
-
-          kubectl \
-            --server=https://10.10.10.210:6443 \
-            --tls-server-name=k8s-api.ahmza.com \
-            --certificate-authority="$KUBE_CA" \
-            --token="$KUBE_TOKEN" \
-            -n blog-ahmza-com \
-            get deployment blog
-
-          echo
-          echo "RBAC checks:"
-
-          kubectl \
-            --server=https://10.10.10.210:6443 \
-            --tls-server-name=k8s-api.ahmza.com \
-            --certificate-authority="$KUBE_CA" \
-            --token="$KUBE_TOKEN" \
-            auth can-i patch deployments \
-            -n blog-ahmza-com
-
-          kubectl \
-            --server=https://10.10.10.210:6443 \
-            --tls-server-name=k8s-api.ahmza.com \
-            --certificate-authority="$KUBE_CA" \
-            --token="$KUBE_TOKEN" \
-            auth can-i get secrets \
-            -n blog-ahmza-com
-
-      - name: Deploy to Kubernetes
-        env:
-          KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }}
-          IMAGE: tea.ahmza.com/ahmza/blog-ahmza-com:${{ gitea.event.head_commit.id }}
-        run: |
-          set -euo pipefail
-
-          k() {
-            kubectl \
-              --server=https://10.10.10.210:6443 \
-              --tls-server-name=k8s-api.ahmza.com \
-              --certificate-authority="$KUBE_CA" \
-              --token="$KUBE_TOKEN" \
-              -n blog-ahmza-com \
-              "$@"
-          }
-
-          echo "Deploying:"
-          echo "  $IMAGE"
-
-          k set image deployment/blog \
-            blog="$IMAGE"
-
-          if ! k rollout status deployment/blog --timeout=5m; then
-            echo "::error::Deployment failed; rolling back"
-
-            k rollout undo deployment/blog
-            k rollout status deployment/blog --timeout=5m
-
-            exit 1
-          fi
-
-          echo
-          k get pods -o wide
-
-          echo
-          echo -n "Running image: "
-          k get deployment blog \
-            -o jsonpath='{.spec.template.spec.containers[?(@.name=="blog")].image}'
-          echo
-
+          args: get pods
 
       - name: NetBird diagnostics & disconnect
         # Runs even on failure: captures final state for debugging and tears the