diff --git a/.github/workflows/unstable.yml b/.github/workflows/unstable.yml
index b8f114e..ec1b82b 100644
--- a/.github/workflows/unstable.yml
+++ b/.github/workflows/unstable.yml
@@ -3,6 +3,10 @@ name: Publish Docker image Dotclear unstable
 on:
   push:
 
+env:
+  IMAGE_NAME: jcpd/docker-dotclear:test
+  DOTCLEAR_CANAL: unstable
+
 jobs:
   push_to_docker_hub:
     name: Push Docker image to registry
@@ -16,25 +20,26 @@ jobs:
       - name: Check out the repo
         uses: actions/checkout@v4
 
-      - name: Log in to Docker Hub
-        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
+          password: ${{ secrets.DOCKER_TOKEN }}
 
-      - name: Build and push Docker image
-        id: push
-        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.IMAGE_NAME }}
+
+      - name: Build and push image
+        uses: docker/build-push-action@v6
         with:
           context: .
+          sbom: true
           push: true
-          tags: jcpd/docker-dotclear:test
-          labels: docker-dotclear:test
-          build-args: CANAL=unstable
-
-      - name: Generate artifact attestation
-        uses: actions/attest-build-provenance@v1
-        with:
-          subject-name: jcpd/docker-dotclear:test
-          subject-digest: ${{ steps.push.outputs.digest }}
-          push-to-registry: true
+          tags: ${{ steps.meta.outputs.tags }}
+          build-args: CANAL=${{ env.DOTCLEAR }}