diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index ab5a4e2..99592ae 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -219,18 +219,17 @@ jobs:
           password: ${{ secrets.ACTIONS_PAT || gitea.token }}
       - name: Build and push Go images (bake)
         env:
-          OWNER_LC: ${{ steps.meta.outputs.owner_lc }}
+          REGISTRY: git.shts.su/${{ steps.meta.outputs.owner_lc }}
+          IMAGE_TAG: latest
           SHORT_SHA: ${{ steps.meta.outputs.short_sha }}
+          SHA_FULL: ${{ github.sha }}
+          CACHE_REF_GO: git.shts.su/${{ steps.meta.outputs.owner_lc }}/evobgp-buildcache:go-buildcache
+          CACHE_REF_WEB: ""
         run: |
           set -euxo pipefail
           cd "${{ github.workspace }}/deploy/docker"
-          docker buildx bake -f docker-bake.hcl go-images \
-            --push \
-            --var "REGISTRY=git.shts.su/${OWNER_LC}" \
-            --var "IMAGE_TAG=latest" \
-            --var "SHORT_SHA=${SHORT_SHA}" \
-            --var "SHA_FULL=${{ github.sha }}" \
-            --var "CACHE_REF_GO=git.shts.su/${OWNER_LC}/evobgp-buildcache:go-buildcache"
+          sh write-bake-override.sh
+          docker buildx bake -f docker-bake.hcl -f docker-bake.override.hcl go-images --push
 
   # ---------------------------------------------------------------------------
   # Docker: Web (evobgp-web, evobgp-web-all) — один npm ci (кэш) + два nginx-тега.
@@ -262,18 +261,17 @@ jobs:
           password: ${{ secrets.ACTIONS_PAT || gitea.token }}
       - name: Build and push Web images (bake)
         env:
-          OWNER_LC: ${{ steps.meta.outputs.owner_lc }}
+          REGISTRY: git.shts.su/${{ steps.meta.outputs.owner_lc }}
+          IMAGE_TAG: latest
           SHORT_SHA: ${{ steps.meta.outputs.short_sha }}
+          SHA_FULL: ${{ github.sha }}
+          CACHE_REF_GO: ""
+          CACHE_REF_WEB: git.shts.su/${{ steps.meta.outputs.owner_lc }}/evobgp-buildcache:web-buildcache
         run: |
           set -euxo pipefail
           cd "${{ github.workspace }}/deploy/docker"
-          docker buildx bake -f docker-bake.hcl web-images \
-            --push \
-            --var "REGISTRY=git.shts.su/${OWNER_LC}" \
-            --var "IMAGE_TAG=latest" \
-            --var "SHORT_SHA=${SHORT_SHA}" \
-            --var "SHA_FULL=${{ github.sha }}" \
-            --var "CACHE_REF_WEB=git.shts.su/${OWNER_LC}/evobgp-buildcache:web-buildcache"
+          sh write-bake-override.sh
+          docker buildx bake -f docker-bake.hcl -f docker-bake.override.hcl web-images --push
 
   # ---------------------------------------------------------------------------
   # Docker: BIRD2 (evobgp-bird2).
@@ -306,14 +304,14 @@ jobs:
           password: ${{ secrets.ACTIONS_PAT || gitea.token }}
       - name: Build and push evobgp-bird2 (bake)
         env:
-          OWNER_LC: ${{ steps.meta.outputs.owner_lc }}
+          REGISTRY: git.shts.su/${{ steps.meta.outputs.owner_lc }}
+          IMAGE_TAG: latest
           SHORT_SHA: ${{ steps.meta.outputs.short_sha }}
+          SHA_FULL: ${{ github.sha }}
+          CACHE_REF_GO: ""
+          CACHE_REF_WEB: ""
         run: |
           set -euxo pipefail
           cd "${{ github.workspace }}/deploy/docker"
-          docker buildx bake -f docker-bake.hcl evobgp-bird2 \
-            --push \
-            --var "REGISTRY=git.shts.su/${OWNER_LC}" \
-            --var "IMAGE_TAG=latest" \
-            --var "SHORT_SHA=${SHORT_SHA}" \
-            --var "SHA_FULL=${{ github.sha }}"
+          sh write-bake-override.sh
+          docker buildx bake -f docker-bake.hcl -f docker-bake.override.hcl evobgp-bird2 --push
diff --git a/deploy/docker/README.md b/deploy/docker/README.md
index 1be88df..93cec87 100644
--- a/deploy/docker/README.md
+++ b/deploy/docker/README.md
@@ -24,15 +24,15 @@
 
 ```bash
 cd deploy/docker
-docker buildx bake -f docker-bake.hcl go-images \
-  --var "REGISTRY=git.shts.su/<owner>" \
-  --var "IMAGE_TAG=latest" \
-  --var "SHORT_SHA=$(git rev-parse --short HEAD)"
-docker buildx bake -f docker-bake.hcl web-images \
-  --var "REGISTRY=git.shts.su/<owner>"
+export REGISTRY=git.shts.su/<owner>
+export IMAGE_TAG=latest
+export SHORT_SHA=$(git rev-parse --short HEAD)
+sh write-bake-override.sh
+docker buildx bake -f docker-bake.hcl -f docker-bake.override.hcl go-images
+docker buildx bake -f docker-bake.hcl -f docker-bake.override.hcl web-images
 ```
 
-Переменные из `variable` в `docker-bake.hcl` передаются флагом **`--var NAME=value`** (не `--set`: он только для полей target вроде `tags`, `args`).
+**CI:** на runner без `buildx bake --var` скрипт `write-bake-override.sh` генерирует `docker-bake.override.hcl` с нужными `variable` (файл не коммитится). Альтернатива на новом buildx: `--var REGISTRY=…` (см. `docker buildx bake --help`).
 
 Один образ (legacy):
 
diff --git a/deploy/docker/write-bake-override.sh b/deploy/docker/write-bake-override.sh
new file mode 100644
index 0000000..6c10368
--- /dev/null
+++ b/deploy/docker/write-bake-override.sh
@@ -0,0 +1,31 @@
+#!/usr/bin/env sh
+# Writes docker-bake.override.hcl for CI (buildx without --var support).
+set -eu
+OUT="${1:-docker-bake.override.hcl}"
+REGISTRY="${REGISTRY:?REGISTRY required}"
+IMAGE_TAG="${IMAGE_TAG:-latest}"
+SHORT_SHA="${SHORT_SHA:-dev}"
+SHA_FULL="${SHA_FULL:-}"
+CACHE_REF_GO="${CACHE_REF_GO:-}"
+CACHE_REF_WEB="${CACHE_REF_WEB:-}"
+cat >"$OUT" <<EOF
+# Generated by deploy/docker/write-bake-override.sh — do not commit.
+variable "REGISTRY" {
+  default = "${REGISTRY}"
+}
+variable "IMAGE_TAG" {
+  default = "${IMAGE_TAG}"
+}
+variable "SHORT_SHA" {
+  default = "${SHORT_SHA}"
+}
+variable "SHA_FULL" {
+  default = "${SHA_FULL}"
+}
+variable "CACHE_REF_GO" {
+  default = "${CACHE_REF_GO}"
+}
+variable "CACHE_REF_WEB" {
+  default = "${CACHE_REF_WEB}"
+}
+EOF