diff --git a/.gitea/workflows/demo-images.yml b/.gitea/workflows/demo-images.yml
index 6a08fb8c..0471538b 100644
--- a/.gitea/workflows/demo-images.yml
+++ b/.gitea/workflows/demo-images.yml
@@ -33,6 +33,12 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
+        with:
+          # The demo registry is plain HTTP — teach buildkit to push without TLS
+          # (the host docker daemon needs it in insecure-registries for login too).
+          buildkitd-config-inline: |
+            [registry."${{ vars.DEMO_REGISTRY_HOST || vars.DEMO_REGISTRY }}"]
+              http = true
 
       - name: Log in to registry
         uses: docker/login-action@v3
diff --git a/.github/workflows/demo-images.yml b/.github/workflows/demo-images.yml
index 6a08fb8c..0471538b 100644
--- a/.github/workflows/demo-images.yml
+++ b/.github/workflows/demo-images.yml
@@ -33,6 +33,12 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
+        with:
+          # The demo registry is plain HTTP — teach buildkit to push without TLS
+          # (the host docker daemon needs it in insecure-registries for login too).
+          buildkitd-config-inline: |
+            [registry."${{ vars.DEMO_REGISTRY_HOST || vars.DEMO_REGISTRY }}"]
+              http = true
 
       - name: Log in to registry
         uses: docker/login-action@v3