diff --git a/docs/PUBLISHING.md b/docs/PUBLISHING.md
index 03914eb..7a4d69f 100644
--- a/docs/PUBLISHING.md
+++ b/docs/PUBLISHING.md
@@ -86,12 +86,20 @@ natives.
 
 The Maven stage runs on the builder's native architecture (the JAR is
 architecture-neutral), so only the jlink and runtime stages run under
-emulation when building `linux/amd64` on Apple Silicon.
-`--provenance=false --sbom=false` matters: Unraid's Docker cannot load the
-attestation manifests BuildKit attaches by default.
+emulation when building `linux/amd64` on Apple Silicon. Two flags matter:
+
+- `--provenance=false --sbom=false`: Unraid's Docker cannot load the
+  attestation manifests BuildKit attaches by default.
+- `--output type=docker,compression=gzip,force-compression=true`:
+  `bitnami/minideb` publishes its base layer as an **uncompressed 133 MB
+  tar**. A daemon using the containerd image store pushes blobs exactly as
+  stored, and Gitea sits behind Cloudflare, which rejects any request body
+  over 100 MB with `413 Payload Too Large`. Forcing gzip on every layer takes
+  that one to about 43 MB; the JAR layer (61 MB) and the JRE layer (41 MB) are
+  already under the limit.
 
 ```bash
-docker build --pull --platform linux/amd64 --provenance=false --sbom=false --build-arg "GIT_SHA=$(git rev-parse HEAD)" --build-arg VERSION=0.7.1 --build-arg "BUILD_TIMESTAMP=$(git log -1 --format=%cI)" -t gitea.milesward.dev/mward4/musicbot:0.7.1 -t gitea.milesward.dev/mward4/musicbot:latest .
+docker buildx build --pull --platform linux/amd64 --provenance=false --sbom=false --build-arg "GIT_SHA=$(git rev-parse HEAD)" --build-arg VERSION=0.7.1 --build-arg "BUILD_TIMESTAMP=$(git log -1 --format=%cI)" -t gitea.milesward.dev/mward4/musicbot:0.7.1 -t gitea.milesward.dev/mward4/musicbot:latest --output type=docker,compression=gzip,force-compression=true .
 ```
 
 Smoke test: an empty, writable data directory must produce a `config.txt` and
diff --git a/scripts/build-and-publish-unraid.sh b/scripts/build-and-publish-unraid.sh
index dc50eed..9630dd8 100755
--- a/scripts/build-and-publish-unraid.sh
+++ b/scripts/build-and-publish-unraid.sh
@@ -109,7 +109,13 @@ COMMIT_TIME="$(git log -1 --format=%cI)"
 # architecture-neutral); only the jlink and runtime stages run under emulation
 # when cross-building linux/amd64 on an arm64 host. BUILD_TIMESTAMP pins the
 # JAR's reproducible-build timestamp to the commit, as upstream's CI does.
-docker build \
+#
+# force-compression matters: bitnami/minideb publishes its base layer as an
+# UNCOMPRESSED 133 MB tar, a daemon with the containerd image store pushes
+# blobs exactly as stored, and Gitea sits behind Cloudflare, which rejects any
+# request body over 100 MB with a 413. Recompressing every layer with gzip
+# brings that layer to ~43 MB; no layer of this image is then over 100 MB.
+docker buildx build \
     --pull \
     --platform "$PLATFORM" \
     --provenance=false --sbom=false \
@@ -118,6 +124,7 @@ docker build \
     --build-arg "BUILD_TIMESTAMP=$COMMIT_TIME" \
     --tag "$FULL_TAG" \
     --tag "$LATEST_TAG" \
+    --output type=docker,compression=gzip,force-compression=true \
     .
 
 # Step 3: registry auth, written straight into the private config (see above).