diff --git a/.gitea/workflows/build-production-docker.yml b/.gitea/workflows/build-production-docker.yml
index 67d6fde..6e4f6c4 100644
--- a/.gitea/workflows/build-production-docker.yml
+++ b/.gitea/workflows/build-production-docker.yml
@@ -91,11 +91,6 @@ jobs:
               --image-scanning-configuration scanOnPush=true \
               --encryption-configuration encryptionType=AES256 >/dev/null
 
-          aws ecr get-login-password --region "${AWS_REGION}" \
-            | docker login --username AWS --password-stdin "${ecr_registry}"
-
-          docker tag "${IMAGE_NAME}:prod-${GITHUB_SHA}" "${ecr_image}:latest"
-
           retry() {
             for attempt in 1 2 3; do
               if "$@"; then
@@ -107,6 +102,14 @@ jobs:
               sleep "$((attempt * 5))"
             done
           }
+
+          ecr_login() {
+            aws ecr get-login-password --region "${AWS_REGION}" \
+              | docker login --username AWS --password-stdin "${ecr_registry}"
+          }
+
+          retry ecr_login
+          docker tag "${IMAGE_NAME}:prod-${GITHUB_SHA}" "${ecr_image}:latest"
           retry docker push "${ecr_image}:latest"
 
           untagged_image_ids="$(aws ecr list-images \