diff --git a/build-push.sh b/build-push.sh
index 7d54504..c85c2cf 100755
--- a/build-push.sh
+++ b/build-push.sh
@@ -5,10 +5,11 @@
 set -euo pipefail
 
 TAG="${1:-latest}"
-REGISTRY="localhost:5000"   # via kubectl port-forward
+# In-cluster address — how the deployment manifest references the image
+REGISTRY="registry.registry.svc.cluster.local:5000"
 IMAGE="$REGISTRY/humor-units:$TAG"
 
-echo "==> Port-forwarding registry..."
+echo "==> Port-forwarding registry (localhost:5000 -> in-cluster registry)..."
 kubectl port-forward -n registry svc/registry 5000:5000 &
 PF_PID=$!
 trap "kill $PF_PID 2>/dev/null" EXIT
@@ -20,8 +21,13 @@ buildah build \
   --tag "$IMAGE" \
   "$(dirname "$0")"
 
-echo "==> Pushing $IMAGE..."
-buildah push --tls-verify=false "$IMAGE"
+echo "==> Pushing via port-forward (localhost:5000)..."
+# Push to localhost:5000 (the port-forward tunnel) but with the in-cluster tag.
+# buildah push accepts a separate destination so we don't retag.
+buildah push \
+  --tls-verify=false \
+  "$IMAGE" \
+  "docker://localhost:5000/humor-units:$TAG"
 
 echo "==> Restarting humor-units deployment..."
 kubectl rollout restart deployment/humor-units -n default