diff --git a/.gitea/workflows/build-and-deploy.yml b/.gitea/workflows/build-and-deploy.yml
index daf0946..a227cad 100644
--- a/.gitea/workflows/build-and-deploy.yml
+++ b/.gitea/workflows/build-and-deploy.yml
@@ -14,7 +14,7 @@ env:
   # TODO: Remove after installing internal CA certificate on the runner
   GIT_SSL_NO_VERIFY: "true"
   REGISTRY_HOST: 192.168.3.80
-  DEPLOY_REGISTRY_HOST: 10.0.0.4
+  DEPLOY_REGISTRY_HOST: 10.0.0.4:5000
   DEPLOY_SSH_HOST: 10.0.0.1
   DOCKERFILE_PATH: Dockerfile.production
   DOCKER_PLATFORM: linux/amd64
@@ -74,8 +74,8 @@ jobs:
           REPO="${{ gitea.repository }}"
           TAG="${{ gitea.sha }}"
           echo "repository=${REPO}" >> "$GITHUB_OUTPUT"
-          echo "full=${REGISTRY_HOST}/${REPO}:${TAG}" >> "$GITHUB_OUTPUT"
-          echo "latest=${REGISTRY_HOST}/${REPO}:latest" >> "$GITHUB_OUTPUT"
+          echo "full=${DEPLOY_REGISTRY_HOST}/${REPO}:${TAG}" >> "$GITHUB_OUTPUT"
+          echo "latest=${DEPLOY_REGISTRY_HOST}/${REPO}:latest" >> "$GITHUB_OUTPUT"
 
       - name: Check Docker registry credentials
         id: registry-check
@@ -267,7 +267,7 @@ jobs:
               exit 1
             fi
             if [ '$PUSH_IMAGE' = 'true' ]; then
-              printf '%s' '$REGISTRY_PASSWORD_B64' | base64 -d | docker login '$REGISTRY_HOST' \
+              printf '%s' '$REGISTRY_PASSWORD_B64' | base64 -d | docker login '$DEPLOY_REGISTRY_HOST' \
                 --username '$REGISTRY_USERNAME' \
                 --password-stdin
             fi
diff --git a/docs/DOCKER.md b/docs/DOCKER.md
index 3555bb3..abd98f3 100644
--- a/docs/DOCKER.md
+++ b/docs/DOCKER.md
@@ -407,6 +407,21 @@ Expected response:
 HTTP/1.1 401 Unauthorized
 ```
 
+When CI builds on the VPS and pushes directly to the local registry, `DEPLOY_REGISTRY_HOST` in `.gitea/workflows/build-and-deploy.yml` must include the registry port, for example `10.0.0.4:5000`. Because the local registry is plain HTTP, configure the VPS Docker daemon once:
+
+```json
+{
+  "insecure-registries": ["10.0.0.4:5000"]
+}
+```
+
+If `/etc/docker/daemon.json` already exists, merge the `insecure-registries` value with the existing JSON instead of replacing the file. Then restart Docker:
+
+```bash
+sudo systemctl restart docker
+docker login 10.0.0.4:5000
+```
+
 Then on the VPS restart Traefik:
 
 ```bash