diff --git a/.woodpecker/docker.yml b/.woodpecker/docker.yml
index 2a1c28c6c..6c74ee077 100644
--- a/.woodpecker/docker.yml
+++ b/.woodpecker/docker.yml
@@ -19,6 +19,24 @@ variables:
   - &platforms_preview 'linux/amd64'
   - &platforms_alpine 'linux/arm/v6,linux/arm/v7,linux/arm64/v8,linux/amd64,linux/ppc64le'
 
+  # vars used on push / tag events only
+  - publish_logins: &publish_logins
+      # Default DockerHub login
+      - registry: https://index.docker.io/v1/
+        username:
+          from_secret: docker_username
+        password:
+          from_secret: docker_password
+      # Additional Quay.IO login
+      - registry: https://quay.io
+        username:
+          from_secret: QUAY_IO_USER
+        password:
+          from_secret: QUAY_IO_TOKEN
+  - &publish_repos_server 'woodpeckerci/woodpecker-server,quay.io/woodpeckerci/woodpecker-server'
+  - &publish_repos_agent 'woodpeckerci/woodpecker-agent,quay.io/woodpeckerci/woodpecker-agent'
+  - &publish_repos_cli 'woodpeckerci/woodpecker-cli,quay.io/woodpeckerci/woodpecker-cli'
+
 steps:
   vendor:
     image: *golang_image
@@ -95,12 +113,12 @@ steps:
   publish-next-server:
     image: woodpeckerci/plugin-docker-buildx
     group: docker
-    secrets: [docker_username, docker_password]
     settings:
-      repo: woodpeckerci/woodpecker-server
+      repo: *publish_repos_server
       dockerfile: docker/Dockerfile.server.multiarch
       platforms: *platforms_server
       tag: [next, "next-${CI_COMMIT_SHA:0:10}"]
+      logins: *publish_logins
     when:
       branch: ${CI_REPO_DEFAULT_BRANCH}
       event: push
@@ -108,12 +126,12 @@ steps:
   publish-next-server-alpine:
     image: woodpeckerci/plugin-docker-buildx
     group: docker
-    secrets: [ docker_username, docker_password ]
     settings:
-      repo: woodpeckerci/woodpecker-server
+      repo: *publish_repos_server
       dockerfile: docker/Dockerfile.server.alpine.multiarch
       platforms: *platforms_alpine
       tag: [next-alpine, "next-${CI_COMMIT_SHA:0:10}-alpine"]
+      logins: *publish_logins
     when:
       branch: ${CI_REPO_DEFAULT_BRANCH}
       event: push
@@ -121,12 +139,12 @@ steps:
   publish-release-branch-server:
     image: woodpeckerci/plugin-docker-buildx
     group: docker
-    secrets: [docker_username, docker_password]
     settings:
-      repo: woodpeckerci/woodpecker-server
+      repo: *publish_repos_server
       dockerfile: docker/Dockerfile.server.multiarch
       platforms: *platforms_server
       tag: ${CI_COMMIT_BRANCH##release/}
+      logins: *publish_logins
     when:
       branch: release/*
       event: push
@@ -134,12 +152,12 @@ steps:
   publish-release-branch-server-alpine:
     image: woodpeckerci/plugin-docker-buildx
     group: docker
-    secrets: [ docker_username, docker_password ]
     settings:
-      repo: woodpeckerci/woodpecker-server
+      repo: *publish_repos_server
       dockerfile: docker/Dockerfile.server.alpine.multiarch
       platforms: *platforms_alpine
       tag: ${CI_COMMIT_BRANCH##release/}
+      logins: *publish_logins
     when:
       branch: release/*
       event: push
@@ -147,26 +165,26 @@ steps:
   release-server:
     group: docker
     image: woodpeckerci/plugin-docker-buildx
-    secrets: [docker_username, docker_password]
     settings:
-      repo: woodpeckerci/woodpecker-server
+      repo: *publish_repos_server
       dockerfile: docker/Dockerfile.server.multiarch
       platforms: *platforms_server
       # remove 'latest' on older version branches to avoid accidental downgrade
       tag: [latest, "${CI_COMMIT_TAG}"]
+      logins: *publish_logins
     when:
       event: tag
 
   release-server-alpine:
     group: docker
     image: woodpeckerci/plugin-docker-buildx
-    secrets: [ docker_username, docker_password ]
     settings:
-      repo: woodpeckerci/woodpecker-server
+      repo: *publish_repos_server
       dockerfile: docker/Dockerfile.server.alpine.multiarch
       platforms: *platforms_alpine
       # remove 'latest-alpine' on older version branches to avoid accidental downgrade
       tag: [latest-alpine, "${CI_COMMIT_TAG}-alpine"]
+      logins: *publish_logins
     when:
       event: tag
 
@@ -189,12 +207,12 @@ steps:
   publish-next-agent:
     group: docker
     image: woodpeckerci/plugin-docker-buildx
-    secrets: [docker_username, docker_password]
     settings:
-      repo: woodpeckerci/woodpecker-agent
+      repo: *publish_repos_agent
       dockerfile: docker/Dockerfile.agent.multiarch
       platforms: *platforms_release
       tag: [next, "next-${CI_COMMIT_SHA:0:10}"]
+      logins: *publish_logins
     when:
       branch: ${CI_REPO_DEFAULT_BRANCH}
       event: push
@@ -202,12 +220,12 @@ steps:
   publish-next-agent-alpine:
     group: docker
     image: woodpeckerci/plugin-docker-buildx
-    secrets: [ docker_username, docker_password ]
     settings:
-      repo: woodpeckerci/woodpecker-agent
+      repo: *publish_repos_agent
       dockerfile: docker/Dockerfile.agent.alpine.multiarch
       platforms: *platforms_alpine
       tag: [next-alpine, "next-${CI_COMMIT_SHA:0:10}-alpine"]
+      logins: *publish_logins
     when:
       branch: ${CI_REPO_DEFAULT_BRANCH}
       event: push
@@ -215,12 +233,12 @@ steps:
   publish-release-branch-agent:
     group: docker
     image: woodpeckerci/plugin-docker-buildx
-    secrets: [docker_username, docker_password]
     settings:
-      repo: woodpeckerci/woodpecker-agent
+      repo: *publish_repos_agent
       dockerfile: docker/Dockerfile.agent.multiarch
       platforms: *platforms_release
       tag: ${CI_COMMIT_BRANCH##release/}
+      logins: *publish_logins
     when:
       branch: release/*
       event: push
@@ -228,12 +246,12 @@ steps:
   publish-release-branch-agent-alpine:
     group: docker
     image: woodpeckerci/plugin-docker-buildx
-    secrets: [ docker_username, docker_password ]
     settings:
-      repo: woodpeckerci/woodpecker-agent
+      repo: *publish_repos_agent
       dockerfile: docker/Dockerfile.agent.alpine.multiarch
       platforms: *platforms_alpine
       tag: ${CI_COMMIT_BRANCH##release/}
+      logins: *publish_logins
     when:
       branch: release/*
       event: push
@@ -241,26 +259,26 @@ steps:
   release-agent:
     group: docker
     image: woodpeckerci/plugin-docker-buildx
-    secrets: [docker_username, docker_password]
     settings:
-      repo: woodpeckerci/woodpecker-agent
+      repo: *publish_repos_agent
       dockerfile: docker/Dockerfile.agent.multiarch
       platforms: *platforms_release
       # remove 'latest' on older version branches to avoid accidental downgrade
       tag: [latest, "${CI_COMMIT_TAG}"]
+      logins: *publish_logins
     when:
       event: tag
 
   release-agent-alpine:
     group: docker
     image: woodpeckerci/plugin-docker-buildx
-    secrets: [ docker_username, docker_password ]
     settings:
-      repo: woodpeckerci/woodpecker-agent
+      repo: *publish_repos_agent
       dockerfile: docker/Dockerfile.agent.alpine.multiarch
       platforms: *platforms_alpine
       # remove 'latest-alpine' on older version branches to avoid accidental downgrade
       tag: [latest-alpine, "${CI_COMMIT_TAG}-alpine"]
+      logins: *publish_logins
     when:
       event: tag
 
@@ -283,12 +301,12 @@ steps:
   publish-next-cli:
     group: docker
     image: woodpeckerci/plugin-docker-buildx
-    secrets: [docker_username, docker_password]
     settings:
-      repo: woodpeckerci/woodpecker-cli
+      repo: *publish_repos_cli
       dockerfile: docker/Dockerfile.cli.multiarch
       platforms: *platforms_release
       tag: [next, "next-${CI_COMMIT_SHA:0:10}"]
+      logins: *publish_logins
     when:
       branch: ${CI_REPO_DEFAULT_BRANCH}
       event: push
@@ -296,12 +314,12 @@ steps:
   publish-next-cli-alpine:
     group: docker
     image: woodpeckerci/plugin-docker-buildx
-    secrets: [ docker_username, docker_password ]
     settings:
-      repo: woodpeckerci/woodpecker-cli
+      repo: *publish_repos_cli
       dockerfile: docker/Dockerfile.cli.alpine.multiarch
       platforms: *platforms_alpine
       tag: [next-alpine, "next-${CI_COMMIT_SHA:0:10}-alpine"]
+      logins: *publish_logins
     when:
       branch: ${CI_REPO_DEFAULT_BRANCH}
       event: push
@@ -309,12 +327,12 @@ steps:
   publish-release-branch-cli:
     group: docker
     image: woodpeckerci/plugin-docker-buildx
-    secrets: [docker_username, docker_password]
     settings:
-      repo: woodpeckerci/woodpecker-cli
+      repo: *publish_repos_cli
       dockerfile: docker/Dockerfile.cli.multiarch
       platforms: *platforms_release
       tag: ${CI_COMMIT_BRANCH##release/}
+      logins: *publish_logins
     when:
       branch: release/*
       event: push
@@ -322,12 +340,12 @@ steps:
   publish-release-branch-cli-alpine:
     group: docker
     image: woodpeckerci/plugin-docker-buildx
-    secrets: [ docker_username, docker_password ]
     settings:
-      repo: woodpeckerci/woodpecker-cli
+      repo: *publish_repos_cli
       dockerfile: docker/Dockerfile.cli.alpine.multiarch
       platforms: *platforms_alpine
       tag: ${CI_COMMIT_BRANCH##release/}
+      logins: *publish_logins
     when:
       branch: release/*
       event: push
@@ -335,25 +353,25 @@ steps:
   release-cli:
     group: docker
     image: woodpeckerci/plugin-docker-buildx
-    secrets: [docker_username, docker_password]
     settings:
-      repo: woodpeckerci/woodpecker-cli
+      repo: *publish_repos_cli
       dockerfile: docker/Dockerfile.cli.multiarch
       platforms: *platforms_release
       # remove 'latest' on older version branches to avoid accidental downgrade
       tag: [latest, "${CI_COMMIT_TAG}"]
+      logins: *publish_logins
     when:
       event: tag
 
   release-cli-alpine:
     group: docker
     image: woodpeckerci/plugin-docker-buildx
-    secrets: [ docker_username, docker_password ]
     settings:
-      repo: woodpeckerci/woodpecker-cli
+      repo: *publish_repos_cli
       dockerfile: docker/Dockerfile.cli.alpine.multiarch
       platforms: *platforms_alpine
       # remove 'latest-alpine' on older version branches to avoid accidental downgrade
       tag: [latest-alpine, "${CI_COMMIT_TAG}-alpine"]
+      logins: *publish_logins
     when:
       event: tag