diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index e42f746..3dad169 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -17,8 +17,14 @@ jobs:
       - name: get registry from current GITHUB_SERVER_URL
         run: echo "REGISTRY=${GITHUB_SERVER_URL//https:\/\//}" >> $GITHUB_ENV
 
+      # Docker tags allow [A-Za-z0-9_.-], up to 128 chars, no leading dot or dash.
+      # The branch name stays in an env var so it is never parsed as shell code.
       - name: build image reference
-        run: echo "IMAGE_URL=${{ env.REGISTRY }}/${GITHUB_REPOSITORY,,}:${{ env.IMAGE_TAG }}" >> $GITHUB_ENV
+        env:
+          RAW_TAG: ${{ env.IMAGE_TAG }}
+        run: |
+          TAG=$(printf '%s' "$RAW_TAG" | tr -c 'A-Za-z0-9_.-' '-' | sed 's/^[.-]*//' | cut -c1-128)
+          echo "IMAGE_URL=${{ env.REGISTRY }}/${GITHUB_REPOSITORY,,}:${TAG}" >> $GITHUB_ENV
 
       - name: Check out repository code
         uses: https://gitea.com/actions/checkout@v3