diff --git a/Dockerfile b/Dockerfile
index ee12a0c..995bc1a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1.7
 
 # ─── Stage 1: web build ───
-FROM node:22-alpine AS web
+FROM registry.jerryyan.top/library/node:22-alpine AS web
 WORKDIR /web
 COPY web/package.json web/pnpm-lock.yaml* ./
 RUN corepack enable && (pnpm install --frozen-lockfile || pnpm install)
@@ -9,7 +9,7 @@ COPY web .
 RUN pnpm build
 
 # ─── Stage 2: go build ───
-FROM golang:1.25-alpine AS go
+FROM registry.jerryyan.top/library/golang:1.25-alpine AS go
 WORKDIR /src
 RUN apk add --no-cache git
 COPY go.mod go.sum ./
@@ -19,7 +19,7 @@ COPY --from=web /web/dist/. ./cmd/server/web/dist/
 RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags='-s -w' -o /out/server ./cmd/server
 
 # ─── Stage 3: runtime ───
-FROM alpine:3.20
+FROM registry.jerryyan.top/library/alpine:3.20
 RUN apk add --no-cache ca-certificates tzdata && \
     addgroup -S app && adduser -S app -G app
 WORKDIR /app
diff --git a/Jenkinsfile b/Jenkinsfile
new file mode 100644
index 0000000..241a752
--- /dev/null
+++ b/Jenkinsfile
@@ -0,0 +1,39 @@
+pipeline {
+    agent any
+
+    environment {
+        REGISTRY  = 'git.jerryyan.net'
+        IMAGE     = "${REGISTRY}/q792602257/agent-coding-workflow"
+        TAG       = sh(script: 'git rev-parse --short HEAD', returnStdout: true).trim()
+    }
+
+    stages {
+        stage('Build & Push') {
+            steps {
+                withCredentials([usernamePassword(
+                    credentialsId: 'gitea-registry',
+                    usernameVariable: 'REGISTRY_USER',
+                    passwordVariable: 'REGISTRY_PASS'
+                )]) {
+                    sh """
+                        docker build -t ${IMAGE}:${TAG} -t ${IMAGE}:latest .
+                        echo "\$REGISTRY_PASS" | docker login ${REGISTRY} -u "\$REGISTRY_USER" --password-stdin
+                        docker push ${IMAGE}:${TAG}
+                        docker push ${IMAGE}:latest
+                    """
+                }
+            }
+            post {
+                always {
+                    sh 'docker logout ${REGISTRY} || true'
+                }
+            }
+        }
+    }
+
+    post {
+        failure {
+            echo "Build failed for commit ${env.TAG}"
+        }
+    }
+}