diff --git a/.woodpecker/linux-release.yml b/.woodpecker/linux-release.yml
index 19a7a58..f366306 100644
--- a/.woodpecker/linux-release.yml
+++ b/.woodpecker/linux-release.yml
@@ -19,11 +19,11 @@ steps:
     image: bash
     environment:
       NUGET_PACKAGES: /home/justme/.nuget/packages
-      ZOT_REGISTRY: 192.168.2.162:5000
+      ZOT_REGISTRY: registry.oeo.one
       ZOT_USERNAME:
         from_secret: zot_username
-      ZOT_PASSWORD:
-        from_secret: zot_password
+      ZOT_SECRET:
+        from_secret: zot_secret
     commands:
       - bash ci/release-linux.sh amd64 backend
     depends_on: []
@@ -32,11 +32,11 @@ steps:
     image: bash
     environment:
       NUGET_PACKAGES: /home/justme/.nuget/packages
-      ZOT_REGISTRY: 192.168.2.162:5000
+      ZOT_REGISTRY: registry.oeo.one
       ZOT_USERNAME:
         from_secret: zot_username
-      ZOT_PASSWORD:
-        from_secret: zot_password
+      ZOT_SECRET:
+        from_secret: zot_secret
     commands:
       - bash ci/release-linux.sh arm64 backend
     depends_on: []
@@ -44,11 +44,12 @@ steps:
   - name: backend-multiarch-index
     image: bash
     environment:
-      ZOT_REGISTRY: 192.168.2.162:5000
+      ZOT_REGISTRY: registry.oeo.one
+      ZOT_SCHEME: https
       ZOT_USERNAME:
         from_secret: zot_username
-      ZOT_PASSWORD:
-        from_secret: zot_password
+      ZOT_SECRET:
+        from_secret: zot_secret
     commands:
       - bash ci/index-backend-image.sh
     depends_on:
diff --git a/ci/index-backend-image.sh b/ci/index-backend-image.sh
index c2d1042..aff521b 100644
--- a/ci/index-backend-image.sh
+++ b/ci/index-backend-image.sh
@@ -9,13 +9,13 @@ version="${CI_COMMIT_TAG#v}"
   exit 2
 }
 
-registry="${ZOT_REGISTRY:-192.168.2.162:5000}"
-scheme="${ZOT_SCHEME:-http}"
+registry="${ZOT_REGISTRY:-registry.oeo.one}"
+scheme="${ZOT_SCHEME:-https}"
 image="monitor/monitor-backend"
 auth_file="$(mktemp)"
 chmod 600 "$auth_file"
 trap 'rm -f "$auth_file"' EXIT
-printf 'machine %s login %s password %s\n' "${registry%%:*}" "$ZOT_USERNAME" "$ZOT_PASSWORD" > "$auth_file"
+printf 'machine %s login %s password %s\n' "${registry%%:*}" "$ZOT_USERNAME" "$ZOT_SECRET" > "$auth_file"
 
 accept='application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json, application/vnd.oci.image.index.v1+json, application/vnd.docker.distribution.manifest.list.v2+json'
 
diff --git a/ci/release-linux.sh b/ci/release-linux.sh
index 9736ac1..51c4715 100644
--- a/ci/release-linux.sh
+++ b/ci/release-linux.sh
@@ -9,7 +9,7 @@ tag="${CI_COMMIT_TAG:-}"
   echo "release must run from a vMAJOR.MINOR.PATCH tag" >&2
   exit 2
 }
-[[ -n "${ZOT_USERNAME:-}" && -n "${ZOT_PASSWORD:-}" ]] || {
+[[ -n "${ZOT_USERNAME:-}" && -n "${ZOT_SECRET:-}" ]] || {
   echo "Zot credentials are required" >&2; exit 2;
 }
 case "$arch" in
@@ -24,7 +24,7 @@ if [[ "$version" != "$project_version" ]]; then
   exit 1
 fi
 
-registry="${ZOT_REGISTRY:-192.168.2.162:5000}"
+registry="${ZOT_REGISTRY:-registry.oeo.one}"
 image="$registry/monitor/monitor-backend"
 output="$root/.release/linux-$arch/backend"
 build_root="$root/.release/build/linux-$arch-backend"
@@ -44,7 +44,7 @@ export REGISTRY_AUTH_FILE="$root/.release/auth/zot-linux-$arch.json"
 mkdir -p "$(dirname "$REGISTRY_AUTH_FILE")"
 logged_in=false
 for attempt in 1 2 3 4; do
-  if buildah login --tls-verify=false --username "$ZOT_USERNAME" --password-stdin "$registry" <<< "$ZOT_PASSWORD" >/dev/null; then
+  if buildah login --tls-verify=true --username "$ZOT_USERNAME" --password-stdin "$registry" <<< "$ZOT_SECRET" >/dev/null; then
     logged_in=true
     break
   fi
@@ -55,13 +55,13 @@ for attempt in 1 2 3 4; do
 done
 [[ "$logged_in" == true ]] || { echo "could not authenticate to Zot after 4 attempts" >&2; exit 1; }
 local_image="localhost/monitor-backend:$version-$arch"
-buildah bud --tls-verify=false --arch "$arch" \
+buildah bud --tls-verify=true --arch "$arch" \
   --build-arg "APP_VERSION=$version" \
   -f "$root/packaging/container/Backend.Containerfile" \
   -t "$local_image" "$container_context" >/dev/null
 pushed=false
 for attempt in 1 2 3; do
-  if buildah push --tls-verify=false "$local_image" "docker://$image:$version-$arch" >/dev/null; then
+  if buildah push --tls-verify=true "$local_image" "docker://$image:$version-$arch" >/dev/null; then
     pushed=true
     break
   fi