diff --git a/Jenkinsfile b/Jenkinsfile
index 1691aca..c1d7cfc 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -157,11 +157,11 @@ pipeline {
                           .
 
                       echo "=== Pushing \$PLAT_REF ==="
-                      # Re-login immediately before push — use -p to avoid any
-                      # stdin piping issues with the masked Jenkins variable.
-                      sudo docker login ${REGISTRY_URL} -u "\$DOCKER_USERNAME" -p "\$DOCKER_PASSWORD" 2>&1 | tail -1
-                      echo "DEBUG: auth config after login:" >&2
-                      sudo cat /root/.docker/config.json 2>/dev/null | head -5 >&2
+                      # Write Harbor auth directly to config.json (bypass docker
+                      # login entirely) — then push with fresh baked-in credentials.
+                      AUTH_B64=\$(printf '%s:%s' "\$DOCKER_USERNAME" "\$DOCKER_PASSWORD" | base64 -w0)
+                      printf '{"auths":{"%s":{"auth":"%s"}}}' "${REGISTRY_URL}" "\$AUTH_B64" | sudo tee /root/.docker/config.json >/dev/null
+                      echo "DEBUG config:" && sudo cat /root/.docker/config.json
                       sudo docker push "\$PLAT_REF" 2>&1 | tail -5
                       sudo docker push "\$PLAT_LATEST" 2>&1 | tail -5
 
@@ -171,7 +171,7 @@ pipeline {
 
                     echo ''
                     echo "=== Creating multi-arch manifest: ${API_IMAGE_TAGGED} ==="
-                    sudo docker login ${REGISTRY_URL} -u "\$DOCKER_USERNAME" -p "\$DOCKER_PASSWORD" 2>&1 | tail -1
+                    AUTH_B64=\$(printf '%s:%s' "\$DOCKER_USERNAME" "\$DOCKER_PASSWORD" | base64 -w0) && printf '{"auths":{"%s":{"auth":"%s"}}}' "${REGISTRY_URL}" "\$AUTH_B64" | sudo tee /root/.docker/config.json >/dev/null && echo "[config written]"
                     sudo docker manifest create "${API_IMAGE_TAGGED}" \
                       "${API_IMAGE_TAGGED}-amd64" \
                       "${API_IMAGE_TAGGED}-arm64"
@@ -271,7 +271,7 @@ pipeline {
                           frontend
 
                       echo "=== Pushing \$PLAT_REF ==="
-                      sudo docker login ${REGISTRY_URL} -u "\$DOCKER_USERNAME" -p "\$DOCKER_PASSWORD" 2>&1 | tail -1
+                      AUTH_B64=\$(printf '%s:%s' "\$DOCKER_USERNAME" "\$DOCKER_PASSWORD" | base64 -w0) && printf '{"auths":{"%s":{"auth":"%s"}}}' "${REGISTRY_URL}" "\$AUTH_B64" | sudo tee /root/.docker/config.json >/dev/null && echo "[config written]"
                       sudo docker push "\$PLAT_REF" 2>&1 | tail -3
                       sudo docker push "\$PLAT_LATEST" 2>&1 | tail -3
                       sudo docker rmi "\$PLAT_REF" "\$PLAT_LATEST" 2>/dev/null || true
@@ -279,7 +279,7 @@ pipeline {
 
                     echo ''
                     echo "=== Creating multi-arch manifest: ${WEB_IMAGE_TAGGED} ==="
-                    sudo docker login ${REGISTRY_URL} -u "\$DOCKER_USERNAME" -p "\$DOCKER_PASSWORD" 2>&1 | tail -1
+                    AUTH_B64=\$(printf '%s:%s' "\$DOCKER_USERNAME" "\$DOCKER_PASSWORD" | base64 -w0) && printf '{"auths":{"%s":{"auth":"%s"}}}' "${REGISTRY_URL}" "\$AUTH_B64" | sudo tee /root/.docker/config.json >/dev/null && echo "[config written]"
                     sudo docker manifest create "${WEB_IMAGE_TAGGED}" \
                       "${WEB_IMAGE_TAGGED}-amd64" \
                       "${WEB_IMAGE_TAGGED}-arm64"