diff --git a/.woodpecker/release.yaml b/.woodpecker/release.yaml
index c48c893..2ad6541 100644
--- a/.woodpecker/release.yaml
+++ b/.woodpecker/release.yaml
@@ -40,10 +40,11 @@ steps:
 
   # Publish under the tag-archive path shape so arti-pack installs itself with
   # registry ".../api/v2/remotes/nvim-plugins/files" and { 'unkin/arti-pack' }.
+  # almalinux9-base trusts the internal CA; alpine does not, so the https PUT
+  # below cannot run there.
   - name: publish
-    image: alpine:3.22
+    image: git.unkin.net/unkin/almalinux9-base:20260606
     commands:
-      - apk add --no-cache curl
       - |
         HOST="https://artifactapi.k8s.syd1.au.unkin.net"
         REPO="nvim-plugins"