diff --git a/Jenkinsfile b/Jenkinsfile
index 54e4fe5..96755e0 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -52,23 +52,6 @@ pipeline {
             }
         }
 
-        stage('Login Registry') {
-            steps {
-                withCredentials([
-                    usernamePassword(
-                        credentialsId: "${DOCKER_CREDS}",
-                        usernameVariable: 'DOCKER_USERNAME',
-                        passwordVariable: 'DOCKER_PASSWORD'
-                    )
-                ]) {
-                    sh """
-                        set -e
-                        echo "\$DOCKER_PASSWORD" | sudo docker login ${REGISTRY_URL} -u "\$DOCKER_USERNAME" --password-stdin
-                    """
-                }
-            }
-        }
-
         stage('Prepare Buildx') {
             steps {
                 sh """
@@ -122,8 +105,18 @@ EOF
 
         stage('Build And Push API Image') {
             steps {
+                withCredentials([
+                    usernamePassword(
+                        credentialsId: "${DOCKER_CREDS}",
+                        usernameVariable: 'DOCKER_USERNAME',
+                        passwordVariable: 'DOCKER_PASSWORD'
+                    )
+                ]) {
                 sh """
                     set -e
+                    # Login to registry (buildx docker-container driver does not
+                    # always forward host auth — --auth below is the authoritative path).
+                    echo "\$DOCKER_PASSWORD" | sudo docker login ${REGISTRY_URL} -u "\$DOCKER_USERNAME" --password-stdin
                     run_with_heartbeat() {
                       log_file="\$1"
                       build_label="\$2"
@@ -170,6 +163,7 @@ EOF
                         --provenance=false \
                         --cache-from type=registry,ref=${API_CACHE_IMAGE} \
                         --cache-to type=registry,ref=${API_CACHE_IMAGE},mode=max \
+                        --auth "${REGISTRY_URL}=\$DOCKER_USERNAME:\$DOCKER_PASSWORD" \
                         --build-arg HTTP_PROXY=${HTTP_PROXY_URL} \
                         --build-arg HTTPS_PROXY=${HTTP_PROXY_URL} \
                         --build-arg NO_PROXY=${NO_PROXY_HOSTS} \
@@ -182,13 +176,22 @@ EOF
                         --push \
                         .
                 """
+                }
             }
         }
 
         stage('Build And Push Web Image') {
             steps {
+                withCredentials([
+                    usernamePassword(
+                        credentialsId: "${DOCKER_CREDS}",
+                        usernameVariable: 'DOCKER_USERNAME',
+                        passwordVariable: 'DOCKER_PASSWORD'
+                    )
+                ]) {
                 sh """
                     set -e
+                    echo "\$DOCKER_PASSWORD" | sudo docker login ${REGISTRY_URL} -u "\$DOCKER_USERNAME" --password-stdin
                     run_with_heartbeat() {
                       log_file="\$1"
                       build_label="\$2"
@@ -235,6 +238,7 @@ EOF
                         --provenance=false \
                         --cache-from type=registry,ref=${WEB_CACHE_IMAGE} \
                         --cache-to type=registry,ref=${WEB_CACHE_IMAGE},mode=max \
+                        --auth "${REGISTRY_URL}=\$DOCKER_USERNAME:\$DOCKER_PASSWORD" \
                         --build-arg NODE_IMAGE=${WEB_NODE_IMAGE} \
                         --build-arg NGINX_IMAGE=${WEB_NGINX_IMAGE} \
                         --build-arg HTTP_PROXY=${HTTP_PROXY_URL} \
@@ -250,6 +254,7 @@ EOF
                         --push \
                         frontend
                 """
+                }
             }
         }
     }