diff --git a/deploy-invttrdg.sh b/deploy-invttrdg.sh
index 7c7c778..25d2167 100755
--- a/deploy-invttrdg.sh
+++ b/deploy-invttrdg.sh
@@ -115,10 +115,55 @@ fi
 
 # Build and start services
 log "Building Docker images..."
-docker compose build || fail "Docker build failed"
+
+# Resolve Gitea npm token for BuildKit secret
+if [ -z "${GITEA_NPM_TOKEN:-}" ]; then
+  if [ -f "/opt/bytelyst/.gitea_token" ]; then
+    GITEA_NPM_TOKEN=$(cat /opt/bytelyst/.gitea_token)
+    export GITEA_NPM_TOKEN
+  elif [ -f "$HOME/.gitea_npm_token" ]; then
+    GITEA_NPM_TOKEN=$(cat "$HOME/.gitea_npm_token")
+    export GITEA_NPM_TOKEN
+  else
+    fail "GITEA_NPM_TOKEN not set and no token file found"
+  fi
+fi
+
+# Collect build metadata (consumed by @bytelyst/devops)
+# Declare separately so set -e + $(…) don't mask non-zero exit codes (SC2155).
+BYTELYST_COMMIT_SHA=
+BYTELYST_COMMIT_SHA_FULL=
+BYTELYST_BRANCH=
+BYTELYST_BUILT_AT=
+BYTELYST_COMMIT_AUTHOR=
+BYTELYST_COMMIT_MESSAGE=
+BYTELYST_COMMIT_SHA=$(git rev-parse --short HEAD 2>/dev/null || echo unknown)
+BYTELYST_COMMIT_SHA_FULL=$(git rev-parse HEAD 2>/dev/null || echo unknown)
+BYTELYST_BRANCH=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo unknown)
+BYTELYST_BUILT_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+BYTELYST_COMMIT_AUTHOR=$(git log -1 --pretty=format:'%an' 2>/dev/null || echo unknown)
+BYTELYST_COMMIT_MESSAGE=$(git log -1 --pretty=format:'%s' 2>/dev/null | head -c 200 || echo unknown)
+
+build_image() {
+  local dockerfile="$1"
+  local tag="$2"
+  docker build --network host \
+    --secret id=gitea_npm_token,env=GITEA_NPM_TOKEN \
+    --build-arg "BYTELYST_COMMIT_SHA=${BYTELYST_COMMIT_SHA}" \
+    --build-arg "BYTELYST_COMMIT_SHA_FULL=${BYTELYST_COMMIT_SHA_FULL}" \
+    --build-arg "BYTELYST_BRANCH=${BYTELYST_BRANCH}" \
+    --build-arg "BYTELYST_BUILT_AT=${BYTELYST_BUILT_AT}" \
+    --build-arg "BYTELYST_COMMIT_AUTHOR=${BYTELYST_COMMIT_AUTHOR}" \
+    --build-arg "BYTELYST_COMMIT_MESSAGE=${BYTELYST_COMMIT_MESSAGE}" \
+    --build-arg "BYTELYST_DOCKER_IMAGE=${tag}" \
+    -f "$dockerfile" -t "$tag" .
+}
+
+build_image backend/Dockerfile invttrdg-backend:latest || fail "Backend build failed"
+build_image web/Dockerfile invttrdg-web:latest || fail "Web build failed"
 
 log "Starting services..."
-docker compose up -d || fail "Docker compose up failed"
+docker compose up -d --no-build || fail "Docker compose up failed"
 
 ok "Deployment completed"