diff --git a/.gitea/workflows/coder-templates.yml b/.gitea/workflows/coder-templates.yml
index 0ad8f89..b75910e 100644
--- a/.gitea/workflows/coder-templates.yml
+++ b/.gitea/workflows/coder-templates.yml
@@ -13,6 +13,19 @@ name: Provision Coder Templates
 #   CODER_URL             e.g. https://code.octoturge.com
 #   CODER_SESSION_TOKEN   a token from `coder tokens create`, ideally under a
 #                          dedicated service account rather than a personal one
+#   GITEA_PACKAGE_TOKEN   a Gitea access token (user Settings > Applications)
+#                          with write:package scope, for pushing templates/web's
+#                          image to this instance's container registry. Only
+#                          the octoturge account's own token is used - login()
+#                          hardcodes that username to match.
+#
+# templates/web builds its Docker image here (build-web-image, on the
+# dedicated "docker-build" runner - see templates/web/main.tf for why: that
+# runner is scoped to this repo only and has host Docker socket access that
+# the shared runner-1 deliberately doesn't). provision then just pulls the
+# tag build-web-image produced, instead of building it itself at
+# `terraform apply` time - keeps the slow Rust toolchain compile off of
+# "someone is waiting to create a workspace".
 
 on:
   push:
@@ -23,7 +36,30 @@ on:
   workflow_dispatch: {}
 
 jobs:
+  build-web-image:
+    runs-on: docker-build
+    container:
+      volumes:
+        - /var/run/docker.sock:/var/run/docker.sock
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Build and push templates/web's image (skips if the tag already exists)
+        run: |
+          set -e
+          TAG="$(sha1sum templates/web/Dockerfile | cut -d' ' -f1)"
+          IMAGE="git.octoturge.com/octo-tech/profiles-web:${TAG}"
+          echo "${{ secrets.GITEA_PACKAGE_TOKEN }}" | docker login git.octoturge.com -u octoturge --password-stdin
+          if docker manifest inspect "$IMAGE" >/dev/null 2>&1; then
+            echo "$IMAGE already in the registry (Dockerfile unchanged), skipping build."
+            exit 0
+          fi
+          docker build -t "$IMAGE" templates/web
+          docker push "$IMAGE"
+
   provision:
+    needs: build-web-image
     runs-on: ubuntu-latest
     env:
       CODER_URL: ${{ secrets.CODER_URL }}
diff --git a/templates/web/main.tf b/templates/web/main.tf
index 9c23b5e..9ee34c6 100644
--- a/templates/web/main.tf
+++ b/templates/web/main.tf
@@ -193,16 +193,18 @@ resource "docker_volume" "home_volume" {
   }
 }
 
-# Builds the full Web Applications toolchain (Rust/Tauri 2, Bun/Node/pnpm,
-# Python CV/ONNX, DB clients - see ./Dockerfile) from this template's own
-# directory, so no external registry push is required. The tag embeds the
-# Dockerfile's hash so a Dockerfile edit forces a rebuild on next apply/push,
-# while an unchanged Dockerfile reuses the cached image.
+# Pulls the full Web Applications toolchain (Rust/Tauri 2, Bun/Node/pnpm,
+# Python CV/ONNX, DB clients - see ./Dockerfile) instead of building it here.
+# The image is built and pushed by .gitea/workflows/coder-templates.yml's
+# build-web-image job, tagged with the same Dockerfile hash this resource
+# computes - so a Dockerfile edit always resolves to the matching image, and
+# an unchanged Dockerfile resolves to one already built (CI skips rebuilding
+# it, and this pull is normally a same-host cache hit rather than a real
+# network pull, since CI and this Coder deployment share one Docker daemon).
+# Moves the ~15-20min Rust toolchain compile off of "someone is waiting to
+# create a workspace" and onto CI, where it runs once per Dockerfile change.
 resource "docker_image" "web" {
-  name = "coder-profiles-web:${filesha1("${path.module}/Dockerfile")}"
-  build {
-    context = path.module
-  }
+  name         = "git.octoturge.com/octo-tech/profiles-web:${filesha1("${path.module}/Dockerfile")}"
   keep_locally = true
 }