diff --git a/.gitea/actions/kaniko-build/build.sh b/.gitea/actions/kaniko-build/build.sh
index f186498..c0e42cd 100644
--- a/.gitea/actions/kaniko-build/build.sh
+++ b/.gitea/actions/kaniko-build/build.sh
@@ -70,7 +70,7 @@ while true; do
   if [ -n "$COMPLETE" ]; then
     echo "Build succeeded"
     kubectl delete job ${JOB_NAME} -n gitea-runner --ignore-not-found
-    exit 0
+    break
   fi
   if [ "${FAILED:-0}" -ge 1 ]; then
     echo "Build failed, logs:"
@@ -80,3 +80,16 @@ while true; do
   fi
   sleep 15
 done
+
+# Update k8s manifests so ArgoCD picks up the new image
+APP_DIR=$(echo "${IMAGE}" | tr '_' '-')
+K8S_DIR=$(mktemp -d)
+git clone --depth=1 "https://${GIT_USERNAME}:${GITEA_TOKEN}@gitea.saltysoup.dev/tanner/k8s.git" "${K8S_DIR}"
+sed -i "s|gitea.saltysoup.dev/tanner/${IMAGE}:.*|gitea.saltysoup.dev/tanner/${IMAGE}:${GITHUB_SHA}|g" \
+  "${K8S_DIR}/apps/${APP_DIR}/deployment.yaml"
+git -C "${K8S_DIR}" config user.email "ci@saltysoup.dev"
+git -C "${K8S_DIR}" config user.name "CI Bot"
+git -C "${K8S_DIR}" add "apps/${APP_DIR}/deployment.yaml"
+git -C "${K8S_DIR}" commit -m "ci: ${IMAGE} → ${GITHUB_SHA:0:8}"
+git -C "${K8S_DIR}" push
+rm -rf "${K8S_DIR}"