diff --git a/Jenkinsfile b/Jenkinsfile
index 549cdc2..1691aca 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -157,9 +157,11 @@ pipeline {
                           .
 
                       echo "=== Pushing \$PLAT_REF ==="
-                      # Re-login immediately before push — Harbor tokens can be
-                      # short-lived and expire during long QEMU builds.
-                      echo "\$DOCKER_PASSWORD" | sudo docker login ${REGISTRY_URL} -u "\$DOCKER_USERNAME" --password-stdin 2>&1 | tail -1
+                      # Re-login immediately before push — use -p to avoid any
+                      # stdin piping issues with the masked Jenkins variable.
+                      sudo docker login ${REGISTRY_URL} -u "\$DOCKER_USERNAME" -p "\$DOCKER_PASSWORD" 2>&1 | tail -1
+                      echo "DEBUG: auth config after login:" >&2
+                      sudo cat /root/.docker/config.json 2>/dev/null | head -5 >&2
                       sudo docker push "\$PLAT_REF" 2>&1 | tail -5
                       sudo docker push "\$PLAT_LATEST" 2>&1 | tail -5
 
@@ -169,7 +171,7 @@ pipeline {
 
                     echo ''
                     echo "=== Creating multi-arch manifest: ${API_IMAGE_TAGGED} ==="
-                    echo "\$DOCKER_PASSWORD" | sudo docker login ${REGISTRY_URL} -u "\$DOCKER_USERNAME" --password-stdin 2>&1 | tail -1
+                    sudo docker login ${REGISTRY_URL} -u "\$DOCKER_USERNAME" -p "\$DOCKER_PASSWORD" 2>&1 | tail -1
                     sudo docker manifest create "${API_IMAGE_TAGGED}" \
                       "${API_IMAGE_TAGGED}-amd64" \
                       "${API_IMAGE_TAGGED}-arm64"
@@ -269,7 +271,7 @@ pipeline {
                           frontend
 
                       echo "=== Pushing \$PLAT_REF ==="
-                      echo "\$DOCKER_PASSWORD" | sudo docker login ${REGISTRY_URL} -u "\$DOCKER_USERNAME" --password-stdin 2>&1 | tail -1
+                      sudo docker login ${REGISTRY_URL} -u "\$DOCKER_USERNAME" -p "\$DOCKER_PASSWORD" 2>&1 | tail -1
                       sudo docker push "\$PLAT_REF" 2>&1 | tail -3
                       sudo docker push "\$PLAT_LATEST" 2>&1 | tail -3
                       sudo docker rmi "\$PLAT_REF" "\$PLAT_LATEST" 2>/dev/null || true
@@ -277,7 +279,7 @@ pipeline {
 
                     echo ''
                     echo "=== Creating multi-arch manifest: ${WEB_IMAGE_TAGGED} ==="
-                    echo "\$DOCKER_PASSWORD" | sudo docker login ${REGISTRY_URL} -u "\$DOCKER_USERNAME" --password-stdin 2>&1 | tail -1
+                    sudo docker login ${REGISTRY_URL} -u "\$DOCKER_USERNAME" -p "\$DOCKER_PASSWORD" 2>&1 | tail -1
                     sudo docker manifest create "${WEB_IMAGE_TAGGED}" \
                       "${WEB_IMAGE_TAGGED}-amd64" \
                       "${WEB_IMAGE_TAGGED}-arm64"