diff --git a/.drone.yml b/.drone.yml
index 860e82c..8285c41 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -1,13 +1,8 @@
 kind: pipeline
 type: docker
-name: check
+name: build-and-publish
 
 services:
-  - name: postgres
-    image: docker.io/library/postgres:17.6
-    environment:
-      POSTGRES_USER: postgres
-      POSTGRES_PASSWORD: postgres
   - name: docker
     image: docker:dind
     privileged: true
@@ -16,26 +11,52 @@ services:
         path: /var/run
 
 trigger:
+  branch:
+    - main
+    - ci-build-container  # TODO: Remove after testing
   event:
     - push
+    - tag
 
 steps:
-  - name: build & publish container?
-    image: docker:dind
+  - name: build-and-publish-container
+    image: docker:cli
     volumes:
       - name: dockersock
         path: /var/run
+    environment:
+      REGISTRY: git.local-it.org/ci-builder
+      IMAGE_NAME: mitgliederverwaltung
+      REGISTRY_USERNAME:
+        from_secret: DRONE_REGISTRY_USERNAME
+      REGISTRY_TOKEN:
+        from_secret: DRONE_REGISTRY_TOKEN
     commands:
       - sleep 6 # give docker time to start
-      - docker build --tag git.local-it.org/ci-builder/mitgliederverwaltung:latest .
-      - docker login --username $DRONE_FORGEJO_ACCOUNT_USERNAME --password $DRONE_FORGEJO_ACCOUNT_PASSWORD git.local-it.org
-      - docker push git.local-it.org/ci-builder/mitgliederverwaltung:latest
+      # Build image once
+      - docker build --tag $REGISTRY/$IMAGE_NAME:build-$DRONE_BUILD_NUMBER .
+      # Login to registry
+      - echo "$REGISTRY_TOKEN" | docker login --username "$REGISTRY_USERNAME" --password-stdin git.local-it.org
+      # Tag and push based on event type
+      - |
+        if [ "$DRONE_BUILD_EVENT" = "tag" ]; then
+          # For tag events: use tag version (e.g., v1.0.0 -> 1.0.0) and latest
+          VERSION=$(echo $DRONE_TAG | sed 's/^v//')
+          echo "Tagging and pushing version $VERSION"
+          docker tag $REGISTRY/$IMAGE_NAME:build-$DRONE_BUILD_NUMBER $REGISTRY/$IMAGE_NAME:$VERSION
+          docker tag $REGISTRY/$IMAGE_NAME:build-$DRONE_BUILD_NUMBER $REGISTRY/$IMAGE_NAME:latest
+          docker push $REGISTRY/$IMAGE_NAME:$VERSION
+          docker push $REGISTRY/$IMAGE_NAME:latest
+        else
+          # For main branch pushes: use commit SHA and latest
+          echo "Tagging and pushing commit $DRONE_COMMIT_SHA"
+          docker tag $REGISTRY/$IMAGE_NAME:build-$DRONE_BUILD_NUMBER $REGISTRY/$IMAGE_NAME:$DRONE_COMMIT_SHA
+          docker tag $REGISTRY/$IMAGE_NAME:build-$DRONE_BUILD_NUMBER $REGISTRY/$IMAGE_NAME:latest
+          docker push $REGISTRY/$IMAGE_NAME:$DRONE_COMMIT_SHA
+          docker push $REGISTRY/$IMAGE_NAME:latest
+        fi
 
 volumes:
-  - name: cache
-    host:
-      path: /tmp/drone_cache
-
   - name: dockersock
     temp: {}