diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 9a02202..909dc8c 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: self-hosted
     steps:
       - name: Install build tools
-        run: apk add --no-cache curl git docker-cli 2>/dev/null || true
+        run: apk add --no-cache curl git docker-cli jq 2>/dev/null || true
 
       - name: Clone + prepare
         run: |
@@ -42,18 +42,14 @@ jobs:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           REGISTRY: ${{ env.REGISTRY }}
 
-      - name: Update image tag in values.yaml (commit-back GitOps)
+      - name: Update ArgoCD
         run: |
-          cd /root/.cache/demo-go-api
           SHORT=${GITHUB_SHA::8}
-          sed -i "s/^  tag:.*/  tag: \"${SHORT}\"/" deploy/helm/values.yaml
-          git config user.email "ci@local"
-          git config user.name "gitea-ci"
-          git add deploy/helm/values.yaml
-          git commit -m "ci: update image tag to ${SHORT}" || echo "nothing to commit"
-          # Try push but don't fail if Gitea is unreachable
-          git push origin main || echo "⚠ push failed - Gitea may be unreachable from cluster"
-          echo "✓ Done with tag ${SHORT}"
+          # Use kubectl to update ArgoCD image tag directly (no git push needed)
+          PATCH=$(jq -n --arg tag "$SHORT" --arg reg "$REGISTRY" \
+            '{"spec":{"source":{"helm":{"parameters":[{"name":"image.registry","value":$reg},{"name":"image.tag","value":$tag}]}}}}')
+          kubectl -n cicd patch application demo-go-api --type=merge -p "$PATCH"
+          echo "✓ ArgoCD updated with tag ${SHORT}"
         env:
           GITHUB_SHA: ${{ github.sha }}
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          REGISTRY: ${{ env.REGISTRY }}