diff --git a/.gitea/workflows/build-push.yaml b/.gitea/workflows/build-push.yaml
index a45c6c8..74cfe7a 100644
--- a/.gitea/workflows/build-push.yaml
+++ b/.gitea/workflows/build-push.yaml
@@ -167,3 +167,67 @@ jobs:
           push: true
           tags: ${{ steps.meta-website.outputs.tags }}
           labels: ${{ steps.meta-website.outputs.labels }}
+
+  build-central-services-api:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v3
+
+      - name: Log in to Docker Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ${{ env.REGISTRY_HOST }}
+          username: ${{ env.ACTOR }}
+          password: ${{ vars.CI_TOKEN }}
+
+      - name: Extract metadata for Central Services API
+        id: meta-central-api
+        uses: docker/metadata-action@v4
+        with:
+          images: ${{ env.REGISTRY_HOST }}/${{ env.IMAGE_NAME }}/central-services-api
+          tags: |
+            type=ref,event=branch
+            type=ref,event=tag
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
+
+      - name: Build and push Central Services API
+        uses: docker/build-push-action@v4
+        with:
+          context: ./push-server
+          file: ./push-server/apps/api/Dockerfile
+          push: true
+          tags: ${{ steps.meta-central-api.outputs.tags }}
+          labels: ${{ steps.meta-central-api.outputs.labels }}
+
+  build-central-services-admin:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v3
+
+      - name: Log in to Docker Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ${{ env.REGISTRY_HOST }}
+          username: ${{ env.ACTOR }}
+          password: ${{ vars.CI_TOKEN }}
+
+      - name: Extract metadata for Central Services Admin
+        id: meta-central-admin
+        uses: docker/metadata-action@v4
+        with:
+          images: ${{ env.REGISTRY_HOST }}/${{ env.IMAGE_NAME }}/central-services-admin
+          tags: |
+            type=ref,event=branch
+            type=ref,event=tag
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
+
+      - name: Build and push Central Services Admin
+        uses: docker/build-push-action@v4
+        with:
+          context: ./push-server
+          file: ./push-server/apps/admin/Dockerfile
+          push: true
+          tags: ${{ steps.meta-central-admin.outputs.tags }}
+          labels: ${{ steps.meta-central-admin.outputs.labels }}
diff --git a/push-server/.env.example b/push-server/.env.example
index ae65f94..ff83470 100644
--- a/push-server/.env.example
+++ b/push-server/.env.example
@@ -3,6 +3,7 @@ CENTRAL_API_DOMAIN=services.fedeo.de
 CENTRAL_ADMIN_DOMAIN=services-admin.fedeo.de
 CONTACT_EMAIL=admin@example.com
 POSTGRES_PASSWORD=change-me-postgres-password
+FEDEO_CENTRAL_TAG=dev
 DATABASE_URL=postgres://fedeo_push:fedeo_push@localhost:5442/fedeo_push
 API_HOST=0.0.0.0
 API_PORT=4020
diff --git a/push-server/README.md b/push-server/README.md
index 744c2a3..85cd7da 100644
--- a/push-server/README.md
+++ b/push-server/README.md
@@ -55,11 +55,21 @@ GOCARDLESS_SECRET_KEY=...
 Ein Neustart nach Änderungen erfolgt mit:
 
 ```bash
+docker compose pull
 docker compose up -d
 docker compose ps
 docker compose logs -f api
 ```
 
+API und Admin werden als fertige Images aus der FEDEO-Registry geladen:
+
+```text
+git.federspiel.tech/flfeders/fedeo/central-services-api:dev
+git.federspiel.tech/flfeders/fedeo/central-services-admin:dev
+```
+
+Über `FEDEO_CENTRAL_TAG` kann in `.env` ein anderer Branch- oder Release-Tag gewählt werden. Auf dem Zielserver findet kein lokaler Image-Build statt.
+
 Traefik leitet HTTP automatisch auf HTTPS um und bezieht Zertifikate per Let’s Encrypt TLS-Challenge. PostgreSQL besitzt keinen Host-Port und ist nur im internen Docker-Netz erreichbar. API und Admin werden ebenfalls nicht direkt über Host-Ports veröffentlicht.
 
 Der API-Container wendet Datenbankmigrationen vor jedem Start automatisch an. PostgreSQL-Daten liegen im Volume `push_postgres_data`; Let’s-Encrypt-Daten liegen unter `traefik/letsencrypt`.
diff --git a/push-server/docker-compose.yml b/push-server/docker-compose.yml
index 170a691..a9a6465 100644
--- a/push-server/docker-compose.yml
+++ b/push-server/docker-compose.yml
@@ -46,9 +46,7 @@ services:
 
   api:
     restart: unless-stopped
-    build:
-      context: .
-      dockerfile: apps/api/Dockerfile
+    image: git.federspiel.tech/flfeders/fedeo/central-services-api:${FEDEO_CENTRAL_TAG:-dev}
     env_file: ${CENTRAL_ENV_FILE:-.env}
     environment:
       DATABASE_URL: postgres://fedeo_push:${POSTGRES_PASSWORD:-fedeo_push}@postgres:5432/fedeo_push
@@ -73,9 +71,7 @@ services:
 
   admin:
     restart: unless-stopped
-    build:
-      context: .
-      dockerfile: apps/admin/Dockerfile
+    image: git.federspiel.tech/flfeders/fedeo/central-services-admin:${FEDEO_CENTRAL_TAG:-dev}
     env_file: ${CENTRAL_ENV_FILE:-.env}
     environment:
       NUXT_PUBLIC_API_BASE: https://${CENTRAL_API_DOMAIN}
diff --git a/push-server/scripts/setup.sh b/push-server/scripts/setup.sh
index 3c89fef..3ffc5bf 100755
--- a/push-server/scripts/setup.sh
+++ b/push-server/scripts/setup.sh
@@ -70,8 +70,9 @@ echo "Die DNS-A/AAAA-Records beider Domains müssen auf diesen Server zeigen."
 
 if [[ "${1:-}" == "--start" ]]; then
   cd "$ROOT_DIR"
-  docker compose up -d --build
+  docker compose pull
+  docker compose up -d
   docker compose ps
 else
-  echo "Start: cd $ROOT_DIR && docker compose up -d --build"
+  echo "Start: cd $ROOT_DIR && docker compose pull && docker compose up -d"
 fi