diff --git a/.gitea/workflows/release_docker.yaml b/.gitea/workflows/release_docker.yaml
index 3af6042..376bc1d 100644
--- a/.gitea/workflows/release_docker.yaml
+++ b/.gitea/workflows/release_docker.yaml
@@ -5,9 +5,40 @@ on:
     branches:
       - master
 jobs:
+  tests:
+    name: tests
+    runs-on: ubuntu-latest
+    steps:
+    - uses: https://github.com/actions/checkout.git@v4
+    - name: Hash of Cargo.lock
+      id: get-hash
+      run: echo "::set-output name=hash::$(md5sum Cargo.lock |  awk '{ print $1; }')"
+    - uses: https://gitea.com/wolfogre/cache/restore@v3
+      id: cache
+      with:
+        key: "${{github.repository}}-cache-cargo-clippy-v4-${{ steps.get-hash.outputs.hash }}"
+        path: |
+          .cache
+          target
+        restore-keys: ${{github.repository}}-cache-cargo-clippy-v4
+    - name: tests
+      uses: nanobyte-public/rust-action@v3
+      with:
+        args: |
+          CARGO_HOME=./.cache cargo-nan \"${{secrets.deployment_package}}\" cargo clippy -- -Dwarnings && \
+          CARGO_HOME=./.cache cargo-nan \"${{secrets.deployment_package}}\" cargo clippy --tests -- -Dwarnings && \
+          CARGO_HOME=./.cache cargo-nan \"${{secrets.deployment_package}}\" cargo test
+    - uses: https://gitea.com/wolfogre/cache/save@v3
+      if: steps.cache.outputs.cache-hit != 'true'
+      with:
+        path: |
+          .cache
+          target
+        key: "${{github.repository}}-cache-cargo-clippy-v4-${{ steps.get-hash.outputs.hash }}"
   docker:
     name: docker
     runs-on: ubuntu-latest
+    needs: tests  # require tests to pass before deploy runs
     container:
       image: ovlach/docker-gitea:v0.0.2-alpha
     steps:
@@ -23,12 +54,12 @@ jobs:
       run: echo "::set-output name=short_hash::$(git rev-parse --short HEAD)"
     - name: Build and push docker
       run: |
-        docker build . -t git.nanobyte.cz/$GITHUB_REPOSITORY_OWNER/ovlach_pdf:${{steps.git.outputs.short_hash}} && \
+        docker build . -t git.nanobyte.cz/$GITHUB_REPOSITORY_OWNER/ovlach_pdf:${{steps.git.outputs.short_hash}} --build-arg GITEA_TOKEN="${{secrets.DEPLOYMENT_PACKAGE}}" && \
         docker push git.nanobyte.cz/$GITHUB_REPOSITORY_OWNER/ovlach_pdf:${{steps.git.outputs.short_hash}}
   stage_deployment:
     name: stage-deployment
     runs-on: ubuntu-latest
-    needs: [docker]  # require tests to pass before deploy runs
+    needs: [docker, tests]  # require tests to pass before deploy runs
     steps:
     - uses: https://github.com/actions/checkout.git@v4
     - name: Get short hash from git repository
@@ -49,4 +80,4 @@ jobs:
         curl -L https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv5.3.0/kustomize_v5.3.0_linux_amd64.tar.gz -o kustomize.tar.gz && tar -xzf kustomize.tar.gz
     - name: Update images
       run: |
-        cd vlach_xyz_deploy && cd kubernetes/staging/ && ../../../kustomize edit set image pdf=git.nanobyte.cz/$GITHUB_REPOSITORY_OWNER/ovlach_pdf:${{steps.git.outputs.short_hash}} && git add . && git commit -m "upgrade ovlach_pdf -> ${{steps.git.outputs.short_hash}}" && git push origin master
+        cd vlach_xyz_deploy && cd kubernetes/staging/ && ../../../kustomize edit set image web=git.nanobyte.cz/$GITHUB_REPOSITORY_OWNER/ovlach_pdf:${{steps.git.outputs.short_hash}} && git add . && git commit -m "upgrade ovlach_pdf -> ${{steps.git.outputs.short_hash}}" && git push origin master
diff --git a/.gitea/workflows/test.yaml b/.gitea/workflows/test.yaml
index 2065d84..9c5bb93 100644
--- a/.gitea/workflows/test.yaml
+++ b/.gitea/workflows/test.yaml
@@ -8,7 +8,7 @@ jobs:
   clippy:
     runs-on: ubuntu-latest
     container:
-      image: git.nanobyte.cz/nanobyte/nano-rust-builder:1.74.5f84654
+      image: git.nanobyte.cz/nanobyte-public/nano-rust-builder:1.74.5f84654
     steps:
       - uses: https://github.com/actions/checkout.git@v4
       - name: Hash of Cargo.lock
@@ -34,7 +34,7 @@ jobs:
           key: "${{github.repository}}-cache-cargo-clippy-v4-${{ steps.get-hash.outputs.hash }}"
   test:
     container:
-        image: git.nanobyte.cz/nanobyte/nano-rust-builder:1.74.5f84654
+        image: git.nanobyte.cz/nanobyte-public/nano-rust-builder:1.74.5f84654
     runs-on: ubuntu-latest
     steps:
       - uses: https://github.com/actions/checkout.git@v4