diff --git a/.forgejo/workflows/deploy-kaniko.yaml b/.forgejo/workflows/deploy-kaniko.yaml
new file mode 100644
index 0000000..f04bfcc
--- /dev/null
+++ b/.forgejo/workflows/deploy-kaniko.yaml
@@ -0,0 +1,24 @@
+---
+name: Kaniko deployments
+
+on:  # yamllint disable-line rule:truthy
+  push:
+    branches:
+      - 'main'
+      - 'ci/debug'
+
+jobs:
+  nextcloud:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: https://code.forgejo.org/actions/checkout@v4
+      - name: Kaniko build
+        uses: aevea/action-kaniko@v0.13.0
+        with:
+          image: catalin/fukuops
+          username: kaniko
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+          cache: true
+          registry: git.roboces.dev
+          tag: nextcloud-30.0.0
+          path: docker/nextcloud
diff --git a/.forgejo/workflows/deploy-tofu.yaml b/.forgejo/workflows/deploy-tofu.yaml
index 211d8db..85808a7 100644
--- a/.forgejo/workflows/deploy-tofu.yaml
+++ b/.forgejo/workflows/deploy-tofu.yaml
@@ -5,7 +5,6 @@ on:  # yamllint disable-line rule:truthy
   push:
     branches:
       - 'main'
-      - 'ci/debug'
 
 jobs:
   authentik:
@@ -28,7 +27,9 @@ jobs:
           TF_VAR_portainer_client_id: ${{ secrets.TF_VAR_portainer_client_id }}
           TF_VAR_portainer_client_secret: ${{ secrets.TF_VAR_portainer_client_secret }}
           TF_VAR_paperless_client_id: ${{ secrets.TF_VAR_paperless_client_id }}
-          TF_VAR_paperless_client_secret: ${{ secrets.TF_VAR_paperless_client_secret }}
+          TF_VAR_paperless_client_secret: ${{ secrets.TF_VAR_paperless_secret }}
+          TF_VAR_netbird_client_id: ${{ secrets.TF_VAR_netbird_client_id }}
+          TF_VAR_netbird_client_secret: ${{ secrets.TF_VAR_netbird_client_secret }}
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
         run: |
diff --git a/Makefile b/Makefile
index 95f8fbe..737fe9b 100644
--- a/Makefile
+++ b/Makefile
@@ -4,16 +4,10 @@ lint--pre-commit:
 lint--kubeconform:
 	kubeconform -strict -ignore-missing-schemas k8s/
 
-SHELl=/bin/bash
-lint--kubescore:
-	kube-score score $$(find k8s -type f -print -name "*.yaml")
-
 lint--tflint:
 	tflint --recursive
 
-
 lint:
 	make lint--pre-commit
 	make lint--kubeconform
-	make lint--kube
 	make lint--tflint
diff --git a/README.md b/README.md
index 4706caa..0ac9c44 100644
--- a/README.md
+++ b/README.md
@@ -2,3 +2,4 @@
 
 [![Last build status](https://git.roboces.dev/catalin/fukuops/badges/workflows/ci.yaml/badge.svg)](https://git.roboces.dev/catalin/fukuops/actions)
 [![Tofu deployments](https://git.roboces.dev/catalin/fukuops/badges/workflows/deploy-tofu.yaml/badge.svg)](https://git.roboces.dev/catalin/fukuops/actions)
+[![Kaniko deployments](https://git.roboces.dev/catalin/fukuops/badges/workflows/deploy-kaniko.yaml/badge.svg)](https://git.roboces.dev/catalin/fukuops/actions)