diff --git a/.task/checksum/build-image b/.task/checksum/build-image
new file mode 100644
index 0000000..a61d80b
--- /dev/null
+++ b/.task/checksum/build-image
@@ -0,0 +1 @@
+427b6d1957a9d2fb92e2e1a5ffeb7d8a
diff --git a/README.md b/README.md
index 64c56a7..e42ad75 100644
--- a/README.md
+++ b/README.md
@@ -13,7 +13,11 @@ compiles the CS8409 mic-fix kernel module (see
 the supported way to drive all of this — run `task` with no arguments to
 list what's available. Notably:
 
-- `task build-image` — builds the image locally (`podman build`, as root).
+- `task build-image` — builds the image locally, as root, with podman, or
+  docker if podman isn't installed (force either with
+  `CONTAINER_RUNTIME=docker|podman`). Every task below works with either;
+  under docker, images are copied via skopeo into a
+  `quine-containers-storage` volume for `bootc-image-builder` to read.
 - `task build-iso` — builds a bootable install ISO from that image via
   `bootc-image-builder`, landing in `output/bootiso/install.iso`.
 - `task build-installer-iso` — builds an install ISO using a custom
@@ -36,7 +40,10 @@ Equivalently, by hand:
 podman build -t quine-linux -f Containerfile .
 ```
 
-An ISO can then be generated from the built image with `bootc-image-builder`.
+An ISO can then be generated from the built image with `bootc-image-builder`
+(`ghcr.io/osbuild/bootc-image-builder`; the project now lives in
+[osbuild/image-builder](https://github.com/osbuild/image-builder), and the old
+`quay.io/centos-bootc/bootc-image-builder` image is no longer updated).
 
 ## overlay/
 
diff --git a/RUNME_PERIODICALLY.sh b/RUNME_PERIODICALLY.sh
index 53a31e3..d023ef4 100755
--- a/RUNME_PERIODICALLY.sh
+++ b/RUNME_PERIODICALLY.sh
@@ -7,8 +7,11 @@ set -e
 echo "== Before =="
 df -h /var/home
 
-echo "== podman: prune unused images/containers/build cache (this is the one that matters) =="
-podman system prune -af
+for rt in podman docker; do
+    command -v "$rt" >/dev/null 2>&1 || continue
+    echo "== $rt: prune unused images/containers/build cache (this is the one that matters) =="
+    "$rt" system prune -af
+done
 
 echo "== ostree: drop rollback deployment =="
 sudo rpm-ostree cleanup -rb
diff --git a/Taskfile.yml b/Taskfile.yml
index f990475..551bc65 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml
@@ -5,6 +5,20 @@ vars:
   INSTALLER_IMAGE: quine-installer
   COPR_REPO: philip-peterson/quine-anaconda-webui
   OUTPUT_DIR: ./output
+  # Any docker-CLI-compatible runtime works for plain builds. Prefers podman,
+  # falls back to docker; override with CONTAINER_RUNTIME=... (env or task var).
+  CONTAINER_RUNTIME:
+    sh: echo "${CONTAINER_RUNTIME:-$(command -v podman >/dev/null 2>&1 && echo podman || echo docker)}"
+  # bootc-image-builder now lives in github.com/osbuild/image-builder and is
+  # published here; quay.io/centos-bootc/bootc-image-builder is frozen.
+  BIB_IMAGE: ghcr.io/osbuild/bootc-image-builder:latest
+  SKOPEO_IMAGE: quay.io/skopeo/stable:latest
+  # bootc-image-builder reads images from a containers-storage mounted at
+  # /var/lib/containers/storage. Under podman that's root's real store; docker
+  # has no such store, so images get copied (via skopeo) into this volume.
+  DOCKER_STORAGE_VOLUME: quine-containers-storage
+  STORAGE: '{{if eq .CONTAINER_RUNTIME "podman"}}/var/lib/containers/storage{{else}}{{.DOCKER_STORAGE_VOLUME}}{{end}}'
+  PULL_FLAG: '{{if eq .CONTAINER_RUNTIME "podman"}}--pull=newer{{else}}--pull=always{{end}}'
 
 tasks:
   default:
@@ -15,11 +29,11 @@ tasks:
 
   build-image:
     desc: >-
-      Build the quine-linux bootc container image, as root (so bootc and
-      bootc-image-builder -- both of which read root's default
-      containers-storage location -- can see the result).
+      Build the quine-linux bootc container image, as root (under podman
+      this lands in root's containers-storage, which bootc and
+      bootc-image-builder read; under docker, the ISO tasks copy it over).
     cmds:
-      - sudo podman build -t {{.IMAGE}} -f Containerfile .
+      - sudo {{.CONTAINER_RUNTIME}} build -t {{.IMAGE}} -f Containerfile .
     sources:
       - Containerfile
       - overlay/**/*
@@ -31,14 +45,16 @@ tasks:
       bootc-image-builder. Output lands in {{.OUTPUT_DIR}}/bootiso/install.iso.
     deps: [build-image]
     cmds:
+      - task: export-to-storage
+        vars: { IMAGES: "{{.IMAGE}}" }
       - mkdir -p {{.OUTPUT_DIR}}
       - >-
-        sudo podman run --rm --privileged --pull=newer
+        sudo {{.CONTAINER_RUNTIME}} run --rm --privileged {{.PULL_FLAG}}
         --security-opt label=type:unconfined_t
         -v {{.OUTPUT_DIR}}:/output
-        -v /var/lib/containers/storage:/var/lib/containers/storage
-        quay.io/centos-bootc/bootc-image-builder:latest
-        --type iso --local {{.IMAGE}}
+        -v {{.STORAGE}}:/var/lib/containers/storage
+        {{.BIB_IMAGE}}
+        --type iso localhost/{{.IMAGE}}
     generates:
       - "{{.OUTPUT_DIR}}/bootiso/install.iso"
 
@@ -50,7 +66,7 @@ tasks:
       {{.COPR_REPO}} COPR project; override with
       `task build-installer-image COPR_REPO=you/other-project`.
     cmds:
-      - sudo podman build -t {{.INSTALLER_IMAGE}} --build-arg COPR_REPO={{.COPR_REPO}} -f installer/Containerfile installer/
+      - sudo {{.CONTAINER_RUNTIME}} build -t {{.INSTALLER_IMAGE}} --build-arg COPR_REPO={{.COPR_REPO}} -f installer/Containerfile installer/
     sources:
       - installer/Containerfile
 
@@ -65,19 +81,38 @@ tasks:
     cmds:
       - task: build-installer-image
         vars: { COPR_REPO: "{{.COPR_REPO}}" }
+      - task: export-to-storage
+        vars: { IMAGES: "{{.IMAGE}} {{.INSTALLER_IMAGE}}" }
       - mkdir -p {{.OUTPUT_DIR}}
       - >-
-        sudo podman run --rm --privileged --pull=newer
+        sudo {{.CONTAINER_RUNTIME}} run --rm --privileged {{.PULL_FLAG}}
         --security-opt label=type:unconfined_t
         -v {{.OUTPUT_DIR}}:/output
-        -v /var/lib/containers/storage:/var/lib/containers/storage
-        quay.io/centos-bootc/bootc-image-builder:latest
+        -v {{.STORAGE}}:/var/lib/containers/storage
+        {{.BIB_IMAGE}}
         --type bootc-installer
         --bootc-installer-payload-ref localhost/{{.IMAGE}}
         localhost/{{.INSTALLER_IMAGE}}
     generates:
       - "{{.OUTPUT_DIR}}/bootc-installer/install.iso"
 
+  export-to-storage:
+    internal: true
+    desc: >-
+      Under docker, copy IMAGES (space-separated local tags) from the docker
+      daemon into the containers-storage volume bootc-image-builder reads.
+      No-op under podman, which builds straight into containers-storage.
+    status:
+      - '[ "{{.CONTAINER_RUNTIME}}" = podman ]'
+    cmds:
+      - for: { var: IMAGES }
+        cmd: >-
+          sudo {{.CONTAINER_RUNTIME}} run --rm --privileged
+          -v /var/run/docker.sock:/var/run/docker.sock
+          -v {{.STORAGE}}:/var/lib/containers/storage
+          {{.SKOPEO_IMAGE}}
+          copy docker-daemon:{{.ITEM}}:latest containers-storage:localhost/{{.ITEM}}:latest
+
   status:
     desc: Show current bootc deployment status (what's booted, what's staged/rollback).
     cmds:
@@ -92,6 +127,11 @@ tasks:
       Reboot separately when ready: `task test:boot`, or `sudo systemctl reboot`.
     deps: [build-image]
     cmds:
+      # bootc reads the host's own containers-storage, i.e. podman's (which
+      # every bootc host ships), so a docker-built image is loaded into it.
+      - cmd: sudo docker save {{.IMAGE}} | sudo podman load
+        platforms: [linux]
+        if: '[ "{{.CONTAINER_RUNTIME}}" != podman ]'
       - sudo bootc switch --transport containers-storage localhost/{{.IMAGE}}
       - bootc status --booted
       - echo "Staged localhost/{{.IMAGE}} for next boot. Run task test:boot when ready to reboot into it."