diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 909dc8c..22eb06e 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: self-hosted
     steps:
       - name: Install build tools
-        run: apk add --no-cache curl git docker-cli jq 2>/dev/null || true
+        run: apk add --no-cache curl git docker-cli 2>/dev/null || true
 
       - name: Clone + prepare
         run: |
@@ -42,14 +42,17 @@ jobs:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           REGISTRY: ${{ env.REGISTRY }}
 
-      - name: Update ArgoCD
+      - name: Update image tag in values.yaml (commit-back GitOps)
         run: |
+          cd /root/.cache/demo-go-api
           SHORT=${GITHUB_SHA::8}
-          # Use kubectl to update ArgoCD image tag directly (no git push needed)
-          PATCH=$(jq -n --arg tag "$SHORT" --arg reg "$REGISTRY" \
-            '{"spec":{"source":{"helm":{"parameters":[{"name":"image.registry","value":$reg},{"name":"image.tag","value":$tag}]}}}}')
-          kubectl -n cicd patch application demo-go-api --type=merge -p "$PATCH"
-          echo "✓ ArgoCD updated with tag ${SHORT}"
+          sed -i "s/^  tag:.*/  tag: \"${SHORT}\"/" deploy/helm/values.yaml
+          git config user.email "ci@local"
+          git config user.name "gitea-ci"
+          git add deploy/helm/values.yaml
+          git commit -m "ci: update image tag to ${SHORT}" || echo "nothing to commit"
+          git push origin main
+          echo "✓ Pushed tag ${SHORT}"
         env:
           GITHUB_SHA: ${{ github.sha }}
-          REGISTRY: ${{ env.REGISTRY }}
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}