diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 1d27408..c82034a 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -53,6 +53,7 @@ jobs:
       - name: Build and Push Image
         env:
           REGISTRY_HOST: ${{ vars.REGISTRY_HOST }}
+          KO_DEFAULTBASEIMAGE: gcr.io/distroless/static-debian12:nonroot
         run: |
           export KO_DOCKER_REPO="${REGISTRY_HOST}/${GITHUB_REPOSITORY_OWNER}"
           ko build --base-import-paths --insecure-registry --sbom=none --tags "main,sha-${GITHUB_SHA}" .