diff --git a/.gitea/workflows/build-runner-image.yml b/.gitea/workflows/build-runner-image.yml
index 175b3b3..6747706 100644
--- a/.gitea/workflows/build-runner-image.yml
+++ b/.gitea/workflows/build-runner-image.yml
@@ -13,7 +13,10 @@ jobs:
   build:
     runs-on: ubuntu-latest
     container:
-      image: node:20-bookworm
+      image: mahgit.ir/meghdadfadaee/daily-blackout-check-base:node-20-bookworm
+      credentials:
+        username: ${{ secrets.REGISTRY_USERNAME }}
+        password: ${{ secrets.REGISTRY_TOKEN }}
     steps:
       - name: Check out repository
         uses: https://gitea.com/actions/checkout@v4
@@ -55,10 +58,8 @@ jobs:
             --username "$REGISTRY_USERNAME" \
             --password-stdin
 
-          # The runner force-pulls this job's node:20-bookworm image before the
-          # job starts. Reuse that fresh host-cached image so BuildKit does not
-          # make a second anonymous Docker Hub token request.
-          DOCKER_BUILDKIT=0 docker build \
+          docker build \
+            --pull \
             --label "org.opencontainers.image.revision=$revision" \
             --label "org.opencontainers.image.source=https://mahgit.ir/MeghdadFadaee/daily-blackout-check" \
             --tag "$candidate" \
diff --git a/README.md b/README.md
index 5a60e0d..c230ca9 100644
--- a/README.md
+++ b/README.md
@@ -73,6 +73,13 @@ It contains Node for the checkout action plus Python, Git, timezone data,
 application dependencies, pytest, and Ruff. Scheduled jobs therefore do not
 install Python or download Python packages.
 
+The Node base image is also mirrored in Gitea, so image builds do not contact
+Docker Hub:
+
+```text
+mahgit.ir/meghdadfadaee/daily-blackout-check-base:node-20-bookworm
+```
+
 ### Registry credentials
 
 Create a Gitea personal access token for `MeghdadFadaee` with package permission
@@ -114,7 +121,8 @@ requests.
 
 The **Build runner image** workflow:
 
-1. Starts in `node:20-bookworm` and installs the Docker client.
+1. Starts in the Gitea-hosted `daily-blackout-check-base:node-20-bookworm`
+   image and installs the Docker client.
 2. Builds using only `runner-image/` as context, so `.env` and outage state are
    never included.
 3. Runs import, pytest, and Ruff smoke checks inside the candidate image.
@@ -122,9 +130,10 @@ The **Build runner image** workflow:
 5. Updates `latest` only after the candidate passes verification.
 
 It runs automatically when `runner-image/**` changes on `main` and can also be
-started manually. Image builds require Debian mirrors, Docker Hub, PyPI, Gitea,
-and access to the Docker socket. Normal test and hourly runs only need Gitea,
-`gitea.com`, SAAPA, and EitaaYar.
+started manually. Image builds require Debian mirrors, PyPI, Gitea, and access
+to the Docker socket. Normal test and hourly runs only need Gitea, `gitea.com`,
+SAAPA, and EitaaYar. The mirrored Node image is intentionally static; refresh it
+from the upstream `node:20-bookworm` image when adopting Node security updates.
 
 Deployment order:
 
diff --git a/runner-image/Dockerfile b/runner-image/Dockerfile
index abd4f23..fd58421 100644
--- a/runner-image/Dockerfile
+++ b/runner-image/Dockerfile
@@ -1,4 +1,4 @@
-FROM node:20-bookworm
+FROM mahgit.ir/meghdadfadaee/daily-blackout-check-base:node-20-bookworm
 
 RUN apt-get update && \
     DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \