diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 3a5115f..6462d49 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -16,6 +16,7 @@ variables:
   MAVEN_CLI_OPTS: "-B -ntp --batch-mode"
   IMAGE_TAG: $CI_COMMIT_REF_SLUG-$CI_COMMIT_SHORT_SHA
   INTERNAL_REGISTRY: registry.k8s.265.nstart.local
+  EXTERNAL_REGISTRY: repo.nstart.cloud
   IMAGE_REPO: terravault
   DOCKER_BUILDKIT: "1"
 
@@ -70,46 +71,63 @@ maven-package:
     DOCKER_HOST: tcp://docker:2375
     DOCKER_TLS_CERTDIR: ""
     DOCKER_BUILDKIT: "1"
+  before_script:
+    - echo "$REGISTRY_PASSWORD" | docker login "$EXTERNAL_REGISTRY" -u "$REGISTRY_USER" --password-stdin
+
+# Helper для dual-push: build один раз с двумя registry-тэгами, push в оба.
+# Internal registry — без auth (insecure), external — с docker login (см. before_script).
+.dual_push_script: &dual_push_script |
+  IMG_INT="$INTERNAL_REGISTRY/$IMAGE_REPO/$SVC"
+  IMG_EXT="$EXTERNAL_REGISTRY/$IMAGE_REPO/$SVC"
+  docker build -f "$DOCKERFILE" \
+    -t "$IMG_INT:$IMAGE_TAG" -t "$IMG_INT:latest" -t "$IMG_INT:$CI_COMMIT_REF_SLUG" \
+    -t "$IMG_EXT:$IMAGE_TAG" -t "$IMG_EXT:latest" -t "$IMG_EXT:$CI_COMMIT_REF_SLUG" \
+    --build-arg BUILDKIT_INLINE_CACHE=1 \
+    "$BUILD_CONTEXT"
+  for TAG in "$IMAGE_TAG" latest "$CI_COMMIT_REF_SLUG"; do
+    docker push "$IMG_INT:$TAG"
+    docker push "$IMG_EXT:$TAG"
+  done
 
 docker-app:
   <<: *docker_base
   needs: [maven-package]
+  variables:
+    SVC: ordinis-app
+    DOCKERFILE: ordinis-app/Dockerfile
+    BUILD_CONTEXT: .
   script:
-    - IMG=$INTERNAL_REGISTRY/$IMAGE_REPO/ordinis-app
-    - docker build -f ordinis-app/Dockerfile -t $IMG:$IMAGE_TAG -t $IMG:latest -t $IMG:$CI_COMMIT_REF_SLUG --build-arg BUILDKIT_INLINE_CACHE=1 .
-    - docker push $IMG:$IMAGE_TAG
-    - docker push $IMG:latest
-    - docker push $IMG:$CI_COMMIT_REF_SLUG
+    - *dual_push_script
 
 docker-read-api:
   <<: *docker_base
   needs: [maven-package]
+  variables:
+    SVC: ordinis-read-api
+    DOCKERFILE: ordinis-read-api/Dockerfile
+    BUILD_CONTEXT: .
   script:
-    - IMG=$INTERNAL_REGISTRY/$IMAGE_REPO/ordinis-read-api
-    - docker build -f ordinis-read-api/Dockerfile -t $IMG:$IMAGE_TAG -t $IMG:latest -t $IMG:$CI_COMMIT_REF_SLUG --build-arg BUILDKIT_INLINE_CACHE=1 .
-    - docker push $IMG:$IMAGE_TAG
-    - docker push $IMG:latest
-    - docker push $IMG:$CI_COMMIT_REF_SLUG
+    - *dual_push_script
 
 docker-projection-writer:
   <<: *docker_base
   needs: [maven-package]
+  variables:
+    SVC: ordinis-projection-writer
+    DOCKERFILE: ordinis-projection-writer/Dockerfile
+    BUILD_CONTEXT: .
   script:
-    - IMG=$INTERNAL_REGISTRY/$IMAGE_REPO/ordinis-projection-writer
-    - docker build -f ordinis-projection-writer/Dockerfile -t $IMG:$IMAGE_TAG -t $IMG:latest -t $IMG:$CI_COMMIT_REF_SLUG --build-arg BUILDKIT_INLINE_CACHE=1 .
-    - docker push $IMG:$IMAGE_TAG
-    - docker push $IMG:latest
-    - docker push $IMG:$CI_COMMIT_REF_SLUG
+    - *dual_push_script
 
 docker-migrations:
   <<: *docker_base
   needs: [maven-package]
+  variables:
+    SVC: ordinis-migrations
+    DOCKERFILE: ordinis-migrations/Dockerfile
+    BUILD_CONTEXT: ordinis-migrations/
   script:
-    - IMG=$INTERNAL_REGISTRY/$IMAGE_REPO/ordinis-migrations
-    - docker build -f ordinis-migrations/Dockerfile -t $IMG:$IMAGE_TAG -t $IMG:latest -t $IMG:$CI_COMMIT_REF_SLUG ordinis-migrations/
-    - docker push $IMG:$IMAGE_TAG
-    - docker push $IMG:latest
-    - docker push $IMG:$CI_COMMIT_REF_SLUG
+    - *dual_push_script
 
 # ─── TRIGGER DEPLOY (downstream pipeline) ──────
 trigger-deploy-staging: