diff --git a/.github/workflows/build-containers.yml b/.github/workflows/build-containers.yml
index 7051949e..99492dee 100644
--- a/.github/workflows/build-containers.yml
+++ b/.github/workflows/build-containers.yml
@@ -143,11 +143,32 @@ jobs:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PASS }}
 
+      # Also publish to the in-cluster registry the k8s deployments actually pull
+      # from. The fraios synmetrix overlays remap cube/actions to
+      # registry.fraios.dev/fraios/*; without this push that registry was only
+      # updated by a manual sync, so CI builds never reached dbx.
+      - name: Log in to fraios registry
+        uses: docker/login-action@v3
+        with:
+          registry: registry.fraios.dev
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+
+      - name: Compute fraios registry image name
+        id: fraios
+        run: echo "image=registry.fraios.dev/fraios/${IMAGE#quicklookup/}" >> "$GITHUB_OUTPUT"
+        env:
+          IMAGE: ${{ matrix.image }}
+
       - name: Extract metadata
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: ${{ matrix.image }}
+          # Same tags pushed to BOTH Docker Hub (external) and our in-cluster
+          # registry (what dbx pulls). build-push-action pushes every tag.
+          images: |
+            ${{ matrix.image }}
+            ${{ steps.fraios.outputs.image }}
           tags: |
             type=ref,event=branch
             type=ref,event=pr