diff --git a/.github/workflows/image-push.yml b/.github/workflows/image-push.yml
index fb01e58..2d55e6d 100644
--- a/.github/workflows/image-push.yml
+++ b/.github/workflows/image-push.yml
@@ -11,19 +11,34 @@ jobs:
       contents: read
       id-token: write
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - linux/amd64
+          - linux/arm64
     steps:
+    - name: Prepare
+      run: |
+        platform=${{ matrix.platform }}
+        echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV  
     - name: Check out code
       uses: actions/checkout@v4
 
+    - name: Docker meta
+      id: meta
+      uses: docker/metadata-action@v5
+      with:
+        images: ${{ env.REGISTRY_IMAGE }}
     - name: Set up QEMU
       uses: docker/setup-qemu-action@v3
 
-    - name: "Read secrets"
-      uses: rancher-eio/read-vault-secrets@main
-      with:
-        secrets: |
-          secret/data/github/repo/${{ github.repository }}/dockerhub/${{ github.repository_owner }}/credentials username | DOCKER_USERNAME ;
-          secret/data/github/repo/${{ github.repository }}/dockerhub/${{ github.repository_owner }}/credentials password | DOCKER_PASSWORD
+    # - name: "Read secrets"
+    #   uses: rancher-eio/read-vault-secrets@main
+    #   with:
+    #     secrets: |
+    #       secret/data/github/repo/${{ github.repository }}/dockerhub/${{ github.repository_owner }}/credentials username | DOCKER_USERNAME ;
+    #       secret/data/github/repo/${{ github.repository }}/dockerhub/${{ github.repository_owner }}/credentials password | DOCKER_PASSWORD
 
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
@@ -31,14 +46,29 @@ jobs:
     - name: Login to Container Registry
       uses: docker/login-action@v3
       with:
-        username: ${{ env.DOCKER_USERNAME }}
-        password: ${{ env.DOCKER_PASSWORD }}
+        username: ${{ secrets.DOCKER_USERNAME }}
+        password: ${{ secrets.DOCKER_PASSWORD }}
 
-    - name: Build container image
+    - name: Build and push by digest
+      id: build
       uses: docker/build-push-action@v5
       with:
         context: .
         push: true
-        tags: rancher/hardened-calico:${{ github.event.release.tag_name }}
+        # tags: rancher/hardened-calico:${{ github.event.release.tag_name }}
         file: Dockerfile
-        platforms: linux/amd64, linux/arm64
+        platforms: ${{ matrix.platform }}
+        outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true
+    - name: Export digest
+      run: |
+        mkdir -p /tmp/digests
+        digest="${{ steps.build.outputs.digest }}"
+        touch "/tmp/digests/${digest#sha256:}"          
+    
+    - name: Upload digest
+      uses: actions/upload-artifact@v4
+      with:
+        name: digests-${{ env.PLATFORM_PAIR }}
+        path: /tmp/digests/*
+        if-no-files-found: error
+        retention-days: 1