diff --git a/flake.nix b/flake.nix
index fe59841..2304a2a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -15,13 +15,26 @@
       system: let
         pkgs = nixpkgs.legacyPackages.${system};
 
-        deploy = pkgs.writeShellScriptBin "deploy" ''
+        deploy-script = pkgs.writeShellScriptBin "deploy" ''
           set -e; set -o pipefail; set -x;
 
+          # 1. Build the docker image
           nix build .#docker
-          image=$((docker load < result) | sed -n '$s/^Loaded image: //p')
-          docker image tag "$image" harbor.julian-mutter.de/sheetless/sheetless-server:latest
-          docker push harbor.julian-mutter.de/sheetless/sheetless-server:latest
+
+          # 2. Authenticate if CI environment variables are present
+          if [ -n "''${REGISTRY_USERNAME:-}" ] && [ -n "''${REGISTRY_PASSWORD:-}" ]; then
+            echo "CI Environment detected: Logging in to Harbor."
+            ${pkgs.skopeo}/bin/skopeo login gitlab.julian-mutter.de \
+              --username "''${HARBOR_USERNAME}" \
+              --password "''${HARBOR_PASSWORD}"
+          else
+            echo "Local Environment detected: Skipping login, relying on existing auth."
+          fi
+
+          # 3. Upload to container registry
+          ${pkgs.skopeo}/bin/skopeo copy \
+              docker-archive:result \
+              docker://gitlab.julian-mutter.de/julian/sheetless-server:latest
         '';
       in {
         devShells.default = pkgs.mkShell {
@@ -30,13 +43,15 @@
             gopls
             go-tools
 
-            deploy
+            deploy-script
           ];
         };
 
         packages = rec {
           default = sheetless-server;
 
+          deploy = deploy-script;
+
           sheetless-server = pkgs.buildGoModule {
             pname = "sheetless-server";
             version = "0.1.0";
@@ -44,11 +59,11 @@
             vendorHash = "sha256-jJe13G5zoUCY2SD9ZerN+6ahc/qOJ3oAhDXJgIhyuvw=";
           };
 
-          docker = pkgs.dockerTools.buildImage {
+          docker = pkgs.dockerTools.buildLayeredImage {
             name = "sheetless-server";
             tag = "latest";
 
-            copyToRoot = with pkgs; [
+            contents = with pkgs; [
               dockerTools.usrBinEnv
               dockerTools.binSh
               dockerTools.caCertificates