diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9dcb050..f1865b3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,7 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - First live registration validated against `git.alwisp.com` (Gitea 1.26.4): instance-level runner registers, comes online, runs healthy, and restart reuses the existing config without creating a duplicate.
 - `.gitea/workflows/ci-smoke.yml`: Phase 3 CI smoke workflow. Runs on the `host` label to validate the bundled toolchain (`actions/checkout@v4`, node/npm/git/docker, mounted Docker socket) directly in the runner container. First run passed.
 - Published `registry.alwisp.com/jason/custom-gitea-runner:v0.1.0` (and `:latest`) — first image release to the Gitea Container Registry.
+- `.gitea/workflows/docker-push.yml`: Phase 3 docker login/build/push validation workflow (`host` label). Run 114 logged in, built, and pushed a test image to the registry — completing Phase 3.
 
 ### Changed
 - `test/sample-workflows/docker-login.yml` and `docker-build-push.yml`: now run on the `host` label instead of `ubuntu-latest`. Docker build/push need the runner's bundled Docker CLI and mounted socket, which the `ubuntu-latest` node job container does not provide. Also fixed a doubled image path in the build/push sample (`gitea.repository` already includes the owner).
diff --git a/forgerunner.src/ROADMAP.md b/forgerunner.src/ROADMAP.md
index 39500bc..00080df 100644
--- a/forgerunner.src/ROADMAP.md
+++ b/forgerunner.src/ROADMAP.md
@@ -139,7 +139,7 @@ The project is considered successful when it can:
 
 ## Phase 3 — Docker workflow support
 
-**Status:** Active (host-toolchain validated; registry push pending credentials)
+**Status:** Complete
 
 ### Goals
 
@@ -150,19 +150,20 @@ The project is considered successful when it can:
 
 - [x] Validate `actions/checkout`
 - [x] Validate Node-based action runtime
-- [ ] Validate `docker/login-action`
-- [ ] Validate `docker build`
-- [ ] Validate `docker push`
-- [ ] Add support notes for self-hosted Gitea Container Registry
+- [x] Validate `docker/login-action`
+- [x] Validate `docker build`
+- [x] Validate `docker push`
+- [x] Add support notes for self-hosted Gitea Container Registry
 - [x] Validate mounted Docker socket usage
-- [ ] Document permission expectations for `/var/run/docker.sock`
-- [ ] Evaluate `buildx` as optional enhancement
+- [x] Document permission expectations for `/var/run/docker.sock`
+- [ ] Evaluate `buildx` as optional enhancement (deferred to Phase 6)
 
 ### Notes
 
 - `.gitea/workflows/ci-smoke.yml` (run 110, `success`) validated on the live runner via the `host` label: `actions/checkout@v4`, bundled node/npm/git/docker versions, and Docker-socket access (`docker info`) all pass.
 - Image published: `registry.alwisp.com/jason/custom-gitea-runner:v0.1.0` + `:latest` (login via the jason Gitea account succeeded; push validated the registry round-trip).
-- `docker/login-action` + `docker build` + `docker push` **from a workflow** still pending: needs repo Action secrets `REGISTRY_USER`/`REGISTRY_TOKEN`. Recommend a dedicated scoped package token rather than the admin API token. Corrected sample workflows (`test/sample-workflows/docker-login.yml`, `docker-build-push.yml`) are ready to run on the `host` label once the secrets exist.
+- `docker/login-action` + `docker build` + `docker push` **from a workflow** validated: `.gitea/workflows/docker-push.yml` (run 114, `success`) logged in to `registry.alwisp.com`, built, and pushed a test image; the artifact was confirmed in the registry then cleaned up.
+- Repo Action secrets `REGISTRY_USER`/`REGISTRY_TOKEN` are set (currently the admin API token — replace with a dedicated `write:package`-scoped token when convenient).
 
 ### Exit criteria