diff --git a/.github/workflows/deploy-bot.yml b/.github/workflows/deploy-bot.yml
index 27c2dcf..7650ae8 100644
--- a/.github/workflows/deploy-bot.yml
+++ b/.github/workflows/deploy-bot.yml
@@ -45,12 +45,16 @@ jobs:
 
       - uses: google-github-actions/setup-gcloud@v2
 
-      - name: Build the image
+      # Built here rather than on Cloud Build: the runner is already amd64, so there is
+      # nothing to cross-compile, and Cloud Build's staging bucket rejects a federated
+      # credential unless a quota project is threaded through it. One less moving part.
+      - name: Build and push the image
         run: |
           IMAGE="${REGION}-docker.pkg.dev/${PROJECT}/polygo/${SERVICE}:${GITHUB_SHA::7}"
           echo "IMAGE=$IMAGE" >> "$GITHUB_ENV"
-          gcloud builds submit --config bot/cloudbuild.yaml \
-            --substitutions="_IMAGE=${IMAGE}" --project "$PROJECT" --quiet .
+          gcloud auth configure-docker "${REGION}-docker.pkg.dev" --quiet
+          docker build -f bot/Dockerfile -t "$IMAGE" .
+          docker push "$IMAGE"
 
       - name: Roll it out
         run: |
diff --git a/bot/cloudbuild.yaml b/bot/cloudbuild.yaml
index c30ede8..5dcb369 100644
--- a/bot/cloudbuild.yaml
+++ b/bot/cloudbuild.yaml
@@ -1,5 +1,6 @@
-# Cloud Build builds the image, because bot/Dockerfile expects the repository root as its
-# context and because a Mac builds arm64 while Cloud Run runs amd64.
+# Cloud Build builds the image when you deploy from a Mac, which is arm64 while Cloud Run
+# is amd64. The GitHub Actions deploy does not use this: its runner is already amd64, so it
+# builds and pushes directly (.github/workflows/deploy-bot.yml).
 #   gcloud builds submit --config bot/cloudbuild.yaml --substitutions=_IMAGE=<image> .
 steps:
   - name: gcr.io/cloud-builders/docker