diff --git a/.woodpecker/docker.yaml b/.woodpecker/docker.yaml
index 12b4a86..463f4b4 100644
--- a/.woodpecker/docker.yaml
+++ b/.woodpecker/docker.yaml
@@ -36,28 +36,28 @@ steps:
             memory: 4Gi
             cpu: 2
 
-  # The default distro also carries the unsuffixed tags.
-  - name: docker-default
+  # The default distro's unsuffixed tags are aliases of the image the step above just
+  # pushed, not a second build of it: imagetools create only writes new tag references
+  # to the existing manifest, so :<version>, :latest and :<version>-<suffix> are one
+  # digest. No daemon is involved; the internal CA is baked into this image at
+  # /etc/docker/certs.d/.
+  - name: docker-default-tags
     image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest"
     when:
       - evaluate: 'DEFAULT == "true"'
-    settings:
-      registry: artifactapi.k8s.syd1.au.unkin.net
-      repo: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder"
-      target: image
-      build_args:
-        BASE_IMAGE_NAME: "${BASE_IMAGE_NAME}"
-        DISTRO: "${DISTRO}"
-      tags:
-        - "${CI_COMMIT_TAG##v}"
-        - latest
+    environment:
+      REPO: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder"
+      VERSION: "${CI_COMMIT_TAG##v}"
+      SUFFIX: "${TAG_SUFFIX}"
+    commands:
+      - 'docker buildx imagetools create -t "$REPO:$VERSION" -t "$REPO:latest" "$REPO:$VERSION-$SUFFIX"'
     backend_options:
       kubernetes:
         serviceAccountName: default
         resources:
           requests:
-            memory: 1Gi
-            cpu: 1
+            memory: 256Mi
+            cpu: 250m
           limits:
-            memory: 4Gi
-            cpu: 2
+            memory: 512Mi
+            cpu: 500m
diff --git a/README.md b/README.md
index 1f0aaee..62355e6 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,8 @@
 
 The estate's Go toolchain image, built on each `container-base` distro image.
 Published as `artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:<version>-<suffix>`;
-the default distro also gets the unsuffixed `:<version>` and `:latest`.
+the default distro's build is retagged as the unsuffixed `:<version>` and `:latest`,
+so all three resolve to one digest.
 
 | distro | from | tag suffix | default |
 | --- | --- | --- | --- |