diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml.disabled
similarity index 100%
rename from .github/workflows/ci.yml
rename to .github/workflows/ci.yml.disabled
diff --git a/.woodpecker/build.yml b/.woodpecker/build.yml
new file mode 100644
index 0000000..87b3312
--- /dev/null
+++ b/.woodpecker/build.yml
@@ -0,0 +1,51 @@
+when:
+  event: push
+  branch: [main, master]
+
+clone:
+  git:
+    image: woodpeckerci/plugin-git
+    settings:
+      attempts: 5
+      backoff: 10s
+
+steps:
+  - name: test
+    image: python:3.12-slim
+    commands:
+      - pip install --no-cache-dir uv
+      - uv sync --all-extras
+      - uv run ruff check src/ tests/
+      - uv run mypy src/claude_memory/
+      - uv run pytest tests/ -v --tb=short
+
+  - name: build-and-push
+    image: woodpeckerci/plugin-docker-buildx
+    depends_on:
+      - test
+    settings:
+      # Dual-push during the Forgejo registry consolidation bake. DockerHub
+      # stays as the canonical pull target until Phase 3 flips
+      # infra/stacks/claude-memory/main.tf to Forgejo. The GHA build (CI)
+      # workflow is .disabled until rollback — see
+      # docs/plans/2026-05-07-forgejo-registry-consolidation-plan.md
+      # § "Risk register".
+      repo:
+        - viktorbarzin/claude-memory-mcp
+        - forgejo.viktorbarzin.me/viktor/claude-memory-mcp
+      logins:
+        - registry: docker.io
+          username:
+            from_secret: dockerhub_username
+          password:
+            from_secret: dockerhub_token
+        - registry: forgejo.viktorbarzin.me
+          username:
+            from_secret: forgejo_user
+          password:
+            from_secret: forgejo_push_token
+      dockerfile: docker/Dockerfile
+      context: .
+      auto_tag: true
+      platforms:
+        - linux/amd64